From 98496dc55c5fa83182ec7a58cf697f86ef83f923 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 15 Jun 2026 05:56:29 -0700 Subject: [PATCH 001/164] add code snippets for escu 6 ymls (#4115) * add code snippets for escu 6 ymsl * Update README.md * Add line to readme abbout snippets * Add demo video link to README Added a demo video link for additional information. * update readme to replace contentctl refs with contentctl-ng. Consistent naming for YAML to YML files. * yml case --------- Co-authored-by: Bhavin Patel Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- .vscode/escu_6.code-snippets | 229 +++++++++++++++++++++++++++++++++++ README.md | 76 ++++++------ 2 files changed, 267 insertions(+), 38 deletions(-) create mode 100644 .vscode/escu_6.code-snippets diff --git a/.vscode/escu_6.code-snippets b/.vscode/escu_6.code-snippets new file mode 100644 index 0000000000..623d309083 --- /dev/null +++ b/.vscode/escu_6.code-snippets @@ -0,0 +1,229 @@ +{ + "New Detection": { + "scope": "yaml", + "prefix": "detection_escu6", + "description": "Scaffold a Splunk Security Content detection YAML", + "body": [ + "name: ${1:${TM_FILENAME_BASE/(^|[_-])(\\w)/${1:+ }${2:/upcase}/g}}", + "id: $UUID", + "version: 1", + "creation_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "modification_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "author: ${2:Your Name, Splunk}", + "status: production", + "type: ${3|TTP,Anomaly,Hunting,Correlation|}", + "description: ${4}", + "data_source:", + " - ", + "search: >-", + " your search here", + " | `${TM_FILENAME_BASE}_filter`", + "how_to_implement: ", + "known_false_positives: ", + "references:", + " - ", + "drilldown_searches:", + " - name: View the detection results for - \"$risk_object$\"", + " search: '%original_detection_search% | search risk_object = \"$risk_object$\"'", + " earliest_offset: $info_min_time$", + " latest_offset: $info_max_time$", + " - name: View risk events for the last 7 days for - \"$risk_object$\"", + " search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN (\"$risk_object$\") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as \"Search Name\" values(risk_message) as \"Risk Message\" values(analyticstories) as \"Analytic Stories\" values(annotations._all) as \"Annotations\" values(annotations.mitre_attack.mitre_tactic) as \"ATT&CK Tactics\" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'", + " earliest_offset: 7d", + " latest_offset: \"0\"", + "finding:", + " title: ", + " entity:", + " field: ", + " type: ", + " score: ", + "intermediate_findings:", + " entities:", + " - field: ", + " type: ", + " score: ", + " message:", + "threat_objects:", + " - field: ", + " type: ", + "analytic_story:", + " - ", + "asset_type: ", + "mitre_attack_id:", + " - ", + "product:", + " - Splunk Enterprise", + " - Splunk Enterprise Security", + " - Splunk Cloud", + "category: ", + "security_domain: ", + "tests:", + " - name: True Positive Test", + " attack_data:", + " - data: ", + " source: ", + " sourcetype: ", + " test_type: unit", + ] + }, + "New Macro": { + "scope": "yaml", + "prefix": "macro_escu6", + "body": [ + "name: ${1:${TM_FILENAME_BASE/([_-])(\\w)/ ${2:/upcase}/g}}", + "id: $UUID", + "version: 1", + "creation_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "modification_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "author: ${1:Splunk Threat Research Team}", + "description: ${2}", + "definition: ${3}", + "$0" + ], + "description": "Scaffold a new Splunk security content macro YAML file" + }, + + "New Data Source": { + "scope": "yaml", + "prefix": "data_source_escu6", + "description": "Scaffold a new Splunk security content data source YAML file", + "body": [ + "name: ${1:${TM_FILENAME_BASE/(^|[_-])(\\w)/${1:+ }${2:/upcase}/g}}", + "id: $UUID", + "version: 1", + "creation_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "modification_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "author: ${1:Splunk Threat Research Team}", + "description: ${3}", + "source: ${4:sourcename}", + "sourcetype: ${5:sourcetype_value}", + "separator: ${6:EventCode}", + "separator_value: '${7}'", + "supported_TA:", + " - name: ${8}", + " url: ${9:hxxps://splunkbase.splunk.com/app/....}", + " version: ${10}", + "fields:", + " - ", + "output_fields:", + " - ", + "mitre_components:", + " - ", + "example_log: '${11}'", + "$0" + ] + }, + + "New Story": { + "scope": "yaml", + "prefix": "story_escu6", + "description": "Scaffold a new Splunk security content analytic story YAML file", + "body": [ + "name: ${1:${TM_FILENAME_BASE/(^|[_-])(\\w)/${1:+ }${2:/upcase}/g}}", + "id: $UUID", + "version: 1", + "creation_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "modification_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "author: ${2:Splunk Threat Research Team}", + "status: production", + "description: ${3}", + "narrative: ${4}", + "references:", + " - ", + "category:", + " - ", + "product:", + " - Splunk Enterprise", + " - Splunk Enterprise Security", + " - Splunk Cloud", + "usecase: ", + "$0" + ] + }, + + "New Lookup (CSV)": { + "scope": "yaml", + "prefix": "lookup_csv_escu6", + "description": "Scaffold a new Splunk security content CSV lookup YAML file", + "body": [ + "name: ${1:${TM_FILENAME_BASE/([_-])(\\w)/ ${2:/upcase}/g}}", + "id: $UUID", + "version: 1", + "creation_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "modification_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "author: ${2:Splunk Threat Research Team}", + "lookup_type: csv", + "description: ${3}", + "match_type:", + " - ${4:WILDCARD()}", + "min_matches: REMOVE ME IF NO MIN MATCHES REQUIRED", + "max_matches: REMOVE ME IF NO MAX MATCHES REQUIRED", + "case_sensitive_match: REMOVE ME IF NO CASE SENSITIVE MATCH REQUIRED", + "$0" + ] + }, + + "New Lookup (KVStore)": { + "scope": "yaml", + "prefix": "lookup_kvstore_escu6", + "description": "Scaffold a new Splunk security content KVStore lookup YAML file", + "body": [ + "name: ${1:${TM_FILENAME_BASE/([_-])(\\w)/ ${2:/upcase}/g}}", + "id: $UUID", + "version: 1", + "creation_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "modification_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "author: ${2:Splunk Threat Research Team}", + "lookup_type: kvstore", + "description: ${3}", + "fields:", + " - _key", + " - ${4:field_name}", + "$0" + ] + }, + + "New Dashboard": { + "scope": "yaml", + "prefix": "dashboard_escu6", + "description": "Scaffold a new Splunk security content dashboard YAML file", + "body": [ + "name: ${1:${TM_FILENAME_BASE/(^|[_-])(\\w)/${1:+ }${2:/upcase}/g}}", + "id: $UUID", + "version: 1", + "creation_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "modification_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "author: ${2:Splunk Threat Research Team}", + "description: ${3:Utilize this dashboard to...}", + "$0" + ] + }, + + "New Baseline": { + "scope": "yaml", + "prefix": "baseline_escu6", + "description": "Scaffold a new Splunk security content baseline YAML file", + "body": [ + "name: ${1:${TM_FILENAME_BASE/(^|[_-])(\\w)/${1:+ }${2:/upcase}/g}}", + "id: $UUID", + "version: 1", + "creation_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "modification_date: '${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}'", + "author: ${2:Splunk Threat Research Team}", + "status: production", + "description: ${3:This search...}", + "search: ${4}", + "how_to_implement: ${5}", + "known_false_positives: ${6}", + "references: []", + "product:", + " - Splunk Enterprise", + " - Splunk Enterprise Security", + " - Splunk Cloud", + "security_domain: ${7}", + "schedule: Default Baseline", + "$0" + ] + } + +} diff --git a/README.md b/README.md index c196f78ae6..e01cf2677f 100644 --- a/README.md +++ b/README.md @@ -25,12 +25,12 @@ Welcome to the Splunk Security Content This project gives you access to our repository of Analytic Stories, security guides that provide background on tactics, techniques and procedures (TTPs), mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls. They include Splunk searches, machine learning algorithms and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats. -**Note:** We have sister projects that enable us to build the industry's best security content. These projects are the Splunk Attack Range, an attack simulation lab built around Splunk, and Contentctl, the tool that enables us to build, test, and package our content for distribution. +**Note:** We have sister projects that enable us to build the industry's best security content. These projects are the Splunk Attack Range, an attack simulation lab built around Splunk, and contentctl-ng, the tool that enables us to build, test, and package our content for distribution. # Tools 🧰 - [Splunk Attack Range](https://github.com/splunk/attack_range): The Splunk Attack Range is an open-source project maintained by the Splunk Threat Research Team. It builds instrumented cloud (AWS, Azure) and local environments (Virtualbox), simulates attacks, and forwards the data into a Splunk instance. This environment can then be used to develop and test the effectiveness of detections. -- [Contentctl](https://github.com/splunk/contentctl): The tool that enables us to build, test, and package our content for distribution. +- [contentctl-ng](https://pypi.org/project/contentctl-ng/): The tool that enables us to build, test, and package our content for distribution. - [Attack data](https://github.com/splunk/attack_data): The is a collection of attack data that is used to test our content. - [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team): Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. @@ -55,7 +55,7 @@ Follow these steps to get started with Splunk Security Content. 1. Clone this repository using `git clone https://github.com/splunk/security_content.git` 2. Navigate to the repository directory using `cd security_content` -3. Install contentctl using `pip install contentctl` to install the latest version of contentctl, this is a pre-requisite to validate, build and test the content like the Splunk Threat Research team +3. Install contentctl-ng using `pip install contentctl-ng` to install the latest version of contentctl-ng, this is a pre-requisite to validate, build and test the content like the Splunk Threat Research team 4. Install pre-commit using `pip install pre-commit` then proceed to installing the hooks via `pre-commit install`. this is a pre-requisite to validate and apply the proper formatting. # Quick Start 🚀 @@ -66,63 +66,63 @@ git clone https://github.com/splunk/security_content.git cd security_content python3.11 -m venv .venv source .venv/bin/activate -pip install contentctl +pip install contentctl-ng ``` -2. Create a new **detection.yml** and answer the questions - ``` - contentctl new - ``` +2. Create a new content YML using VSCode Snippets detailed below - -**NOTE** - Make sure you update the detection.yml with the required fields and values. If you need help, please refer to the [yaml-spec](docs/yaml-spec) to check out the list of allowed values - -4. Validate your content +3. Validate your content and build an app ``` -contentctl validate +contentctl-ng build ``` -**NOTE** - The contentctl validate command ensures that all YAML files adhere to the defined specifications and are up-to-date. It checks for required fields, correct data types, and overall consistency, helping maintain the integrity and quality of the content. +**NOTE** - The contentctl build command ensures that all YML files adhere to the defined specifications and are up-to-date. It checks for required fields, correct data types, and overall consistency, helping maintain the integrity and quality of the content. -5. Build an ESCU app with enrichments from Atomic Red Team and Mitre CTI repositories -``` -contentctl build --enrichments -``` +# VS Code Snippets ✂️ + +This repo ships snippets in [.vscode/escu_6.code-snippets](.vscode/escu_6.code-snippets) to scaffold new content quickly in VS Code. + +1. Create a new `.yml` file in the appropriate content directory (e.g. `detections/`, `macros/`, `stories/`) and give it a descriptive name. This name will be used to populate the `name: ` field of your YML as well. +2. Type one of the snippet prefixes below and press `Tab` (or select it from the IntelliSense popup and press `Enter`) to expand a pre-filled template. +3. Fill in the relevant fields for your content. You may remove any optional fields which are not relevant to this piece of content. -6. Test the content - Our testing framework is based on [contentctl](https://github.com/splunk/contentctl) and is extensive and flexible. Refer to the [contentctl test documentation](https://github.com/splunk/contentctl?tab=readme-ov-file#contentctl-test) to learn more about the testing framework. +Available prefixes exist for `detection_escu6` , `macro_escu6`, `data_source_escu6`, `story_escu6`, `lookup_csv_escu6`, `lookup_kvstore_escu6` , `dashboard_escu6`, and `baseline_escu6` . +Please see the demo video below for more information + +https://github.com/user-attachments/assets/1be02afa-36b5-4d49-91cb-8ebbcf4123d0 # Recommendations 💡 -- 🚨 NOTE: If you are just getting started with managing your Splunk detection as code, we recommend that you keep the YAML structure of the detections as close as possible to the original structure of the detections. This will make it easier to manage your detections and will also make it easier to contribute back to the community by creating a pull request to the Splunk Security Content project. +- 🚨 NOTE: If you are just getting started with managing your Splunk detection as code, we recommend that you keep the YML structure of the detections as close as possible to the original structure of the detections. This will make it easier to manage your detections and will also make it easier to contribute back to the community by creating a pull request to the Splunk Security Content project. -- In order to build an content app that specific for your organization, we strongly recommend that you start with keeping only the detections that are related to your organization and remove other yamls that are not related to your organization. This includes selecting detections, stories, macros, lookups that are used by the detection ymls. +- In order to build an content app that specific for your organization, we strongly recommend that you start with keeping only the detections that are related to your organization and remove other YML files that are not related to your organization. This includes selecting detections, stories, macros, lookups that are used by the detection YML files. - If your detections are using macros and lookups, please make sure that you have the same macros and lookups in those directories.. This will ensure that the content app is self-contained and does not rely on external files. -- We recommend that you follow the errors produced by the `contentctl` tool while developing this content. The errors are descriptive enough to guide you in getting the right values. If you need help, please open a GitHub issue in the `contentctl` repository or refer to the [yaml-spec](docs/yaml-spec) to check out the list of allowed values - +- We recommend that you follow the errors produced by the `contentctl-ng` tool while developing this content. The errors are descriptive enough to guide you in getting the right values. If you need help, please refer to the [JSON Schemas](#json-schemas) to check out the list of allowed values -# YAML Specs 📄 +# Json Schemas 📄 -YAML specs define the structure and required fields for various YAML configuration files used in the project. These specifications ensure consistency and validation across different types of YAML files, such as macros, lookups, and analytic stories. Each spec outlines the expected data types, descriptions, and whether the fields are mandatory, providing a clear schema for developers to follow. +The JSON schemas defined in the [/schemas](/schemas/) folder, define the structure and required fields for various YML files used in the project. These specifications ensure consistency and validation across different types of YML files, such as macros, lookups, and analytic stories. Each spec outlines the expected data types, descriptions, and whether the fields are mandatory, providing a clear schema for developers to follow. -- [detection](https://github.com/splunk/security_content/blob/develop/docs/yaml-spec/detection_spec.yml) -- [stories](https://github.com/splunk/security_content/blob/develop/docs/yaml-spec/stories_spec.yml) -- [macros](https://github.com/splunk/security_content/blob/develop/docs/yaml-spec/macros_spec.yml) -- [lookups](https://github.com/splunk/security_content/blob/develop/docs/yaml-spec/lookups_spec.yml) +- [detection](schemas/EventBasedDetection.schema.json) +- [stories](schemas/Story.schema.json) +- [macros](schemas/FileBackedMacro.schema.json) +- [lookups](schemas/CsvLookup.schema.json) +- [baseline](schemas/Baseline.schema.json) +- [playbook](schemas/Playbook.schema.json) +- [data_source](schemas/DataSource.schema.json) # Content Parts 🧩 -* [detections/](detections/): Contains all detection searches to-date and growing. -* [stories/](stories/): All Analytic Stories that are group detections or also known as Use Cases -* [deployments/](deployments/): Configuration for the schedule and alert action for all content -* [playbooks/](playbooks/): Incident Response Playbooks/Workflow for responding to a specific Use Case or Threat. * [baselines/](baselines/): Searches that must be executed before a detection runs. It is specifically useful for collecting data on a system before running your detection on the collected data. -* [investigations/](investigations/): Investigations to further analyze the output from detections. For more information, you can refer to the [Splunk Enterprise Security documentation on timelines](https://help.splunk.com/en/splunk-enterprise-security-7/user-guide/7.3/investigations/investigations-in-splunk-enterprise-security). -* [macros/](macros/): Implements Splunk’s search macros, shortcuts to commonly used search patterns like sysmon source type. More on how macros are used to customize content below. -* [lookups/](lookups/): Implements Splunk’s lookup, usually to provide a list of static values like commonly used ransomware extensions. * [data_sources/](data_sources/): Defines the data sources, the necessary TA or App to collect them and the fields provided that can be used by the detections. - +* [deployments/](deployments/): Configuration for the schedule and alert action for all content +* [detections/](detections/): Contains all detection searches to-date and growing. +* [lookups/](lookups/): Implements Splunk’s lookup, usually to provide a list of static values like commonly used ransomware extensions. +* [macros/](macros/): Implements Splunk’s search macros, shortcuts to commonly used search patterns like sysmon source type. More on how macros are used to customize content below. +* [playbooks/](playbooks/): Incident Response Playbooks/Workflow for responding to a specific Use Case or Threat. +* [stories/](stories/): All Analytic Stories that are group detections or also known as Use Cases # MITRE ATT&CK ⚔️ ### Detection Coverage @@ -142,7 +142,7 @@ If you have questions or need support, you can: * Join the [#security-research](https://splunkcommunity.slack.com/archives/CDNHXVBGS) channel in the [Splunk Community Slack.](https://splk.it/slack) ## License -Copyright 2022 Splunk Inc. +Copyright 2026 Splunk Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. From 0e953aa15d3ec4201f4bd9ee8021330809573de8 Mon Sep 17 00:00:00 2001 From: Mikael Bjerkeland Date: Mon, 15 Jun 2026 15:46:12 +0200 Subject: [PATCH 002/164] Rewrote HTTP Scripting Tool User Agent to Web DM (#4125) --------- Co-authored-by: Mikael Bjerkeland Co-authored-by: Nasreddine Bencherchali --- .../web/http_scripting_tool_user_agent.yml | 40 ++++++++++++------- 1 file changed, 26 insertions(+), 14 deletions(-) diff --git a/detections/web/http_scripting_tool_user_agent.yml b/detections/web/http_scripting_tool_user_agent.yml index d2426ea962..341a9952f8 100644 --- a/detections/web/http_scripting_tool_user_agent.yml +++ b/detections/web/http_scripting_tool_user_agent.yml @@ -10,18 +10,28 @@ description: This Splunk query analyzes web access logs to identify and categori data_source: - Nginx Access search: |- - `nginx_access_logs` - | eval http_user_agent = lower(http_user_agent) - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Web)` - | lookup scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool - | where isnotnull(tool) - | rename dest_ip as dest - | stats count min(firstTime) as first_seen max(lastTime) as last_seen values(tool) as tool - BY http_user_agent dest src_ip - status - | `http_scripting_tool_user_agent_filter` + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Web where + Web.http_user_agent =* + NOT Web.http_user_agent IN ( + "-", + "unknown" + ) + by Web.http_user_agent Web.dest Web.src Web.status + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Web)` + | eval http_user_agent = lower(http_user_agent) + | lookup scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool + | where isnotnull(tool) + | stats count + min(firstTime) as first_seen + max(lastTime) as last_seen + values(tool) as tool + by http_user_agent dest src status + | `security_content_ctime(first_seen)` + | `security_content_ctime(last_seen)` + | `http_scripting_tool_user_agent_filter` how_to_implement: This analytic necessitates the collection of web data, which can be achieved through Splunk Stream or by utilizing the Splunk Add-on for Apache Web Server. No additional configuration is required for this analytic. known_false_positives: False positives may be present if the activity is part of diagnostics or testing. Filter as needed. references: @@ -45,10 +55,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: Known scripting tool was used against a web request. The source IP is $src_ip$ and the destination is $dest$. + message: Known scripting tool was used against a web request. The source IP/Host is $src$ and the destination is $dest$. threat_objects: - - field: src_ip + - field: src type: ip_address + - field: http_user_agent + type: http_user_agent analytic_story: - HTTP Request Smuggling - Suspicious User Agents From 7870ff5935e9432129e6f301e517b5fe3876a7f7 Mon Sep 17 00:00:00 2001 From: bpluta-splunk <121967154+bpluta-splunk@users.noreply.github.com> Date: Mon, 15 Jun 2026 09:10:33 -0500 Subject: [PATCH 003/164] new o11y secure application detection (#4108) * new o11y secure application detection * name change * name change * updating as per contentctl ng requirements * adding dest_ip for entitiy * updating dataset * how to implement update * updated lantern link * testing yaml lint * Update macros/secureapp_attack.yml Co-authored-by: Nasreddine Bencherchali * Update detections/application/splunk_secure_application_alerts_for_runtime_security.yml Co-authored-by: Nasreddine Bencherchali * removing macro * updating version? * Update http_scripting_tool_user_agent.yml --------- Co-authored-by: Bhavin Patel Co-authored-by: Bhavin Patel Co-authored-by: Nasreddine Bencherchali --- ...pplication_alerts_for_runtime_security.yml | 91 +++++++++++++++++++ .../web/http_scripting_tool_user_agent.yml | 4 +- macros/secureapp_attack.yml | 8 ++ 3 files changed, 101 insertions(+), 2 deletions(-) create mode 100644 detections/application/splunk_secure_application_alerts_for_runtime_security.yml create mode 100644 macros/secureapp_attack.yml diff --git a/detections/application/splunk_secure_application_alerts_for_runtime_security.yml b/detections/application/splunk_secure_application_alerts_for_runtime_security.yml new file mode 100644 index 0000000000..7a9a439215 --- /dev/null +++ b/detections/application/splunk_secure_application_alerts_for_runtime_security.yml @@ -0,0 +1,91 @@ +name: Splunk Secure Application Alerts for Runtime Security +id: 37365336-e8af-42b1-b9d5-a5183d7b7e73 +version: 1 +creation_date: '2026-06-12' +modification_date: '2026-06-12' +author: Ryan Long, Bhavin Patel, Bryan Pluta, Splunk +status: experimental +type: Anomaly +description: | + The following analytic leverages alerts from Splunk Secure Application, which identifies and monitors exploit attempts targeting business applications. Attacks observed include exploiting vulnerabilities in web applications, such as injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution, LOG4J, and zero-day attacks. These events are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality. + + Splunk Secure Application provides real-time detection of these threats by analyzing application-layer events and correlating attack behavior with known vulnerability signatures. This detection methodology helps the Security Operations Center (SOC) by: + + * Identifying active exploitation attempts in real-time, allowing for quicker incident response. + * Categorizing attack severity to prioritize remediation efforts based on risk level. + * Providing visibility into attacker tactics, including source IP, attack techniques, and affected applications. + * Generating risk-based scoring and contextual alerts to enhance decision-making within SOC workflows. + * Helping analysts determine whether an attack was merely an attempt or if it successfully exploited a vulnerability. + + By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation. +data_source: [] +search: |- + `secureapp_attack` + | rename attackEvents{}.* AS *, detailJson.* AS *, vulnerabilityInfo.* AS * + | fields - tag::eventtype, eventtype, host, id, index, linecount, punct, source, sourcetype, splunk_server, tag, SourceType, app, clientAddressType, "attackEvents{}.* status" + | eval socketOut=mvjoin(socketOut," AND ") + | eval risk_score=kennaScore + | fillnull risk_score value="0" + `secureapp_es_field_mappings` + | dedup gid + | eval severity=case( + risk_score>=75 OR signature="LOG4J", "critical", + risk_score>50 AND risk_score<75, "high", + risk_score=0 AND attackOutcome="EXPLOITED", "high", + risk_score<=50 AND attackOutcome!="OBSERVED", "medium", + risk_score=0 AND attackOutcome="ATTEMPTED", "medium", + risk_score=0, "low", + risk_score=0 AND attackOutcome="OBSERVED", "low" + ) + | eval rule_description=case( + attacktypecount>1, mvjoin(mvappend("Multiple different attack types have been seen against the application", mvdedup(app), "This includes", mvdedup(signature), "attacks. Review the", mvdedup(dest_nt_host), "server for signs of exploitation"), " "), + (signature="API" OR signature="LOG4J" OR signature="SSRF"), "An attempt to exploit a ".signature." vulnerability was made from a ".src_category." IP address ".src_ip.". The server ".dest_nt_host." hosting application ".app." was accessed, and data may have been exfiltrated to ".ip.".", + (signature="SQL"), "IP address ".src_ip." has attempted a SQL injection via ".src_category.". The server ".dest_nt_host." hosting application ".app." may have executed this SQL statement and should be reviewed.", + (signature="DESEREAL"), "The application ".app." deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Data which is untrusted cannot be trusted to be well-formed. Malformed data or unexpected data could be used to abuse application logic, deny service, or execute arbitrary code, when deserialized.", + (signature="RCE"), "An attacker tried to perform Remote Code Execution by running the command ".command." in the ".file_path." directory. The server ".dest_nt_host." hosting application ".app." ".action." this command." + ) + | `splunk_secure_application_alerts_for_runtime_security_filter` +how_to_implement: | + Create the secureapp_attack sourcetype in Splunk Enterprise Security. Configure Splunk Enterprise Security to receive alerts for Observability Cloud via HEC. Configure Secure Application Alerts in Observability Cloud to send alerts to Enterprise Security. Full details can be found in the referenced lantern article. +known_false_positives: | + No known false positives for this detection. If alerts are noisy, tune this detection with the `_filter` macro or configure the originating tool. +references: + - https://lantern.splunk.com/@go/page/10379 + - https://help.splunk.com/en/splunk-observability-cloud/monitor-application-security/set-up-secure-application/step-1-set-up-notifications-for-vulnerabilities +drilldown_searches: + - name: View the detection results for - "$app$" + search: '%original_detection_search% | search app = "$app$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest_ip$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest_ip + type: system + score: 20 + message: $rule_description$ +threat_objects: + - field: src_ip + type: ip_address +analytic_story: + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/secure_app_alerts_runtime_security.log + sourcetype: secureapp_attack + source: not_applicable + description: | + MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL, which supersedes the risk score set in the detection. Set as manual test to avoid integration and unit test failures due to empty fields in observables. + test_type: experimental diff --git a/detections/web/http_scripting_tool_user_agent.yml b/detections/web/http_scripting_tool_user_agent.yml index 341a9952f8..629822d8dd 100644 --- a/detections/web/http_scripting_tool_user_agent.yml +++ b/detections/web/http_scripting_tool_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP Scripting Tool User Agent id: 04430b4e-5ca8-4e88-98b5-d6bcf54f8393 -version: 5 +version: 6 creation_date: '2025-10-21' -modification_date: '2026-05-13' +modification_date: '2026-06-15' author: Raven Tait, Splunk status: production type: Anomaly diff --git a/macros/secureapp_attack.yml b/macros/secureapp_attack.yml new file mode 100644 index 0000000000..205e9ebb3a --- /dev/null +++ b/macros/secureapp_attack.yml @@ -0,0 +1,8 @@ +name: secureapp_attack +id: a4e47c1d-9fb1-4fee-b3e2-68d2f3a8bd2a +version: 1 +creation_date: '2026-06-12' +modification_date: '2026-06-12' +author: Bhavin Patel, Bryan Pluta, Splunk +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. +definition: sourcetype=secureapp_attack \ No newline at end of file From e9400d99aafa6934f3ebd7d02d620b634b8d0590 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 15 Jun 2026 16:47:25 +0200 Subject: [PATCH 004/164] PTC Windchill (#4124) * add windchill analytics * indent --------- Co-authored-by: Bhavin Patel --- data_sources/windchill_log4j.yml | 26 +++++ ...tc_windchill_gateway_command_execution.yml | 102 ++++++++++++++++++ .../ptc_windchill_gw_ready_ok_probe.yml | 97 +++++++++++++++++ macros/windchill_log4j.yml | 8 ++ stories/ptc_windchill_exploitation.yml | 28 +++++ 5 files changed, 261 insertions(+) create mode 100644 data_sources/windchill_log4j.yml create mode 100644 detections/application/ptc_windchill_gateway_command_execution.yml create mode 100644 detections/application/ptc_windchill_gw_ready_ok_probe.yml create mode 100644 macros/windchill_log4j.yml create mode 100644 stories/ptc_windchill_exploitation.yml diff --git a/data_sources/windchill_log4j.yml b/data_sources/windchill_log4j.yml new file mode 100644 index 0000000000..de3a5e644e --- /dev/null +++ b/data_sources/windchill_log4j.yml @@ -0,0 +1,26 @@ +name: Windchill Log4j +id: f33af1fb-df5c-45c5-b8fd-20b0bbfb5415 +version: 1 +creation_date: '2026-06-14' +modification_date: '2026-06-14' +author: Nasreddine Bencherchali, Splunk +description: PTC Windchill MethodServer log4j logs containing servlet request and method context activity from Windchill application components. +mitre_components: + - Application Log Content + - Network Traffic Content + - Response Metadata +source: not_applicable +sourcetype: log4j +supported_TA: [] +fields: + - _time + - _raw + - log_level + - thread + - logger + - src_ip + - uri_path + - query_string + - http_method + - status +example_log: '2026-03-26 19:12:00,053 ERROR [ajp-nio-127.0.0.1-10660-exec-2] wt.servlet.ServletRequestMonitor.request - 2026-03-26 19:12:00.049 +0530, q4io1jf;mn7i98pd;62288;2anc4x;4122, -, 10.10.2.3, /Windchill/servlet/WindchillGW/GW/run, c=whoami, GET, 500, 0.0037325, 0.004020767' diff --git a/detections/application/ptc_windchill_gateway_command_execution.yml b/detections/application/ptc_windchill_gateway_command_execution.yml new file mode 100644 index 0000000000..eb2192745f --- /dev/null +++ b/detections/application/ptc_windchill_gateway_command_execution.yml @@ -0,0 +1,102 @@ +name: PTC Windchill Gateway Command Execution +id: d725b390-fe86-47df-b9a1-57497915403e +version: 1 +creation_date: '2026-06-14' +modification_date: '2026-06-14' +author: Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: | + This analytic detects Windchill MethodServer log4j events showing suspicious `c=` command execution or `p=` file read parameters sent to Windchill gateway paths associated with CVE-2026-4681 exploitation. + PTC identifies `run?c=`, `run?p=`, `.jsp?c=`, and `.jsp?p=` request patterns as indicators to monitor during Windchill and FlexPLM exploitation response. + Successful activity may allow an unauthenticated attacker to execute operating system commands or read files through a weaponized gateway or JSP component. +data_source: + - Windchill Log4j +search: |- + `windchill_log4j` + ("WindchillGW/GW/run" OR "WindchillAuthGW/GW/run" OR "/GW/run?" OR "run?c=" OR "run?p=" OR ".jsp?c=" OR ".jsp?p=" OR "dpr_") + | rex field=_raw "^(?:[^:\r\n]+:)?(?\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2},\d{3})\s+(?\w+)\s+\[(?[^\]]+)\]\s+(?\S+)\s+-\s+(?.*)$" + | search logger IN ("wt.servlet.ServletRequestMonitor.request", "wt.method.MethodContextMonitor.contexts.servletRequest") + | rex field=payload "^(?\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d{3})\s+(?[+\-]\d{4}),\s+(?.*)$" + | eval parts=split(rest,", ") + | eval event_type=case(logger="wt.servlet.ServletRequestMonitor.request","servlet_request",logger="wt.method.MethodContextMonitor.contexts.servletRequest","method_context_servlet_request",true(),"other") + | eval src_ip=case(event_type="servlet_request",mvindex(parts,2),event_type="method_context_servlet_request",mvindex(parts,5)) + | eval uri_path=case(event_type="servlet_request",mvindex(parts,3),event_type="method_context_servlet_request",mvindex(parts,8)) + | eval query_string=if(event_type="servlet_request",mvindex(parts,4),null()) + | eval http_method=if(event_type="servlet_request",mvindex(parts,5),null()) + | eval status=if(event_type="servlet_request",tonumber(mvindex(parts,6)),null()) + | rex field=uri_path "^(?[^\?]+)(?:\?(?.*))?$" + | eval query_string=if(query_string="-",null(),query_string) + | eval query_string=coalesce(query_string,uri_query) + | rex field=query_string "(?i)(?:^|&)(?[cp])=(?[^&]*)" + | eval query_param=lower(query_param), query_value=urldecode(replace(query_value,"\+","%20")) + | where isnotnull(uri_only) AND isnotnull(query_param) + | where (match(uri_only,"(?i)(^|/)GW/run$") OR match(uri_only,"(?i)/servlet/(WindchillGW|WindchillAuthGW)/GW/run$") OR match(uri_only,"(?i)(^|/)dpr_[0-9a-f]{8}\.jsp$")) AND (query_param="c" OR query_param="p") + | where NOT (query_param="c" AND match(query_value,"(?i)^echo(\s|20)+GW_READY_OK$")) + | eval activity=case(query_param="c","command_execution_parameter",query_param="p","file_read_parameter",true(),"unknown") + | eval src=src_ip + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(log_level) as log_level + values(logger) as logger + values(http_method) as http_method + values(status) as status + values(uri_only) as uri_path + values(query_string) as query_string + by src activity query_param query_value + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `ptc_windchill_gateway_command_execution_filter` +how_to_implement: | + To implement this analytic, ingest PTC Windchill MethodServer log4j logs into Splunk with sourcetype `log4j`. + Update the `windchill_log4j` macro to include the appropriate index constraints for your environment. + The analytic expects log entries from the `wt.servlet.ServletRequestMonitor.request` and `wt.method.MethodContextMonitor.contexts.servletRequest` loggers and parses embedded servlet URI, query parameter, source IP, HTTP method, and status fields. +known_false_positives: | + Requests to `GW/run` or randomly named `dpr_<8 hex>.jsp` files with `c=` or `p=` parameters should not be expected during normal Windchill operation. + Validate whether red-team testing, vulnerability scanning, or incident response replay generated the activity before closing as benign. +references: + - https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability + - https://nvd.nist.gov/vuln/detail/CVE-2026-4681 + - https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-03 +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: Potential PTC Windchill gateway command or file read activity detected from $src$. +threat_objects: + - field: src + type: ip_address +analytic_story: + - PTC Windchill Exploitation +asset_type: Web Application +cve: + - CVE-2026-4681 +mitre_attack_id: + - T1190 + - T1059 + - T1005 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/windchill/windchill_exploitation.log + source: not_applicable + sourcetype: log4j + test_type: unit diff --git a/detections/application/ptc_windchill_gw_ready_ok_probe.yml b/detections/application/ptc_windchill_gw_ready_ok_probe.yml new file mode 100644 index 0000000000..9685e478de --- /dev/null +++ b/detections/application/ptc_windchill_gw_ready_ok_probe.yml @@ -0,0 +1,97 @@ +name: PTC Windchill GW READY OK Probe +id: 2f37ab99-5eae-44c4-a6bc-15b6d9787a3d +version: 1 +creation_date: '2026-06-14' +modification_date: '2026-06-14' +author: Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: | + This analytic detects Windchill MethodServer log4j events that contain the CVE-2026-4681 exploitation probe `run?c=echo%20GW_READY_OK`. + PTC identifies `GW_READY_OK` and related `run?c=` activity as log indicators associated with Windchill and FlexPLM exploitation. + This behavior is significant because attackers use the probe to confirm that a staged gateway component is reachable before sending operating system commands through the same `c=` parameter. +data_source: + - Windchill Log4j +search: |- + `windchill_log4j` + ("GW_READY_OK" OR "run?c=echo%20GW_READY_OK" OR "c=echo%20GW_READY_OK") + | rex field=_raw "^(?:[^:\r\n]+:)?(?\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2},\d{3})\s+(?\w+)\s+\[(?[^\]]+)\]\s+(?\S+)\s+-\s+(?.*)$" + | search logger IN ("wt.servlet.ServletRequestMonitor.request", "wt.method.MethodContextMonitor.contexts.servletRequest") + | rex field=payload "^(?\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d{3})\s+(?[+\-]\d{4}),\s+(?.*)$" + | eval parts=split(rest,", ") + | eval event_type=case(logger="wt.servlet.ServletRequestMonitor.request","servlet_request",logger="wt.method.MethodContextMonitor.contexts.servletRequest","method_context_servlet_request",true(),"other") + | eval src_ip=case(event_type="servlet_request",mvindex(parts,2),event_type="method_context_servlet_request",mvindex(parts,5)) + | eval uri_path=case(event_type="servlet_request",mvindex(parts,3),event_type="method_context_servlet_request",mvindex(parts,8)) + | eval query_string=if(event_type="servlet_request",mvindex(parts,4),null()) + | eval http_method=if(event_type="servlet_request",mvindex(parts,5),null()) + | eval status=if(event_type="servlet_request",tonumber(mvindex(parts,6)),null()) + | rex field=uri_path "^(?[^\?]+)(?:\?(?.*))?$" + | eval query_string=if(query_string="-",null(),query_string) + | eval query_string=coalesce(query_string,uri_query) + | rex field=query_string "(?i)(?:^|&)(?[cp])=(?[^&]*)" + | eval query_param=lower(query_param), query_value=urldecode(replace(query_value,"\+","%20")) + | where query_param="c" AND match(query_value,"(?i)^echo(\s|20)+GW_READY_OK$") + | eval src=src_ip, activity="gw_ready_ok_probe" + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(log_level) as log_level + values(logger) as logger + values(http_method) as http_method + values(status) as status + values(uri_only) as uri_path + values(query_string) as query_string + by src activity query_param query_value + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `ptc_windchill_gw_ready_ok_probe_filter` +how_to_implement: | + To implement this analytic, ingest PTC Windchill MethodServer log4j logs into Splunk with sourcetype `log4j`. + Update the `windchill_log4j` macro to include the appropriate index constraints for your environment. + The analytic expects log entries from the `wt.servlet.ServletRequestMonitor.request` and `wt.method.MethodContextMonitor.contexts.servletRequest` loggers. +known_false_positives: | + This probe string is specific to the PTC-published Windchill exploitation indicators. False positives should be rare. Validate whether any internal testing, incident response activity, or vendor diagnostics intentionally generated `GW_READY_OK` requests. +references: + - https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability + - https://nvd.nist.gov/vuln/detail/CVE-2026-4681 + - https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-03 +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: PTC Windchill GW READY OK exploitation probe detected from $src$. +threat_objects: + - field: src + type: ip_address +analytic_story: + - PTC Windchill Exploitation +asset_type: Web Application +cve: + - CVE-2026-4681 +mitre_attack_id: + - T1190 + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/windchill/windchill_exploitation.log + source: not_applicable + sourcetype: log4j + test_type: unit diff --git a/macros/windchill_log4j.yml b/macros/windchill_log4j.yml new file mode 100644 index 0000000000..223ef49f4a --- /dev/null +++ b/macros/windchill_log4j.yml @@ -0,0 +1,8 @@ +name: windchill_log4j +id: 0b89b4b9-f91d-447c-abe9-24d9c5ff3ae2 +version: 1 +creation_date: '2026-06-14' +modification_date: '2026-06-14' +author: Nasreddine Bencherchali, Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. +definition: sourcetype=log4j diff --git a/stories/ptc_windchill_exploitation.yml b/stories/ptc_windchill_exploitation.yml new file mode 100644 index 0000000000..7f8ea2c29f --- /dev/null +++ b/stories/ptc_windchill_exploitation.yml @@ -0,0 +1,28 @@ +name: PTC Windchill Exploitation +id: 3edf40e6-d641-48e1-a6d2-0eed37284dd5 +version: 1 +creation_date: '2026-06-14' +modification_date: '2026-06-14' +author: Nasreddine Bencherchali, Splunk +status: production +description: | + Leverage searches that allow you to detect and investigate activity that may relate to exploitation of PTC Windchill and FlexPLM CVE-2026-4681. +narrative: | + CVE-2026-4681 is a critical remote code execution vulnerability affecting PTC Windchill PDMLink and FlexPLM. PTC reports that the vulnerability may be exploited through deserialization of untrusted data and published urgent mitigation guidance for Windchill and FlexPLM environments. + + During exploitation, attackers may stage gateway or JSP components and then interact with them through suspicious HTTP request patterns. PTC identifies `run?c=`, `run?p=`, `.jsp?c=`, and `.jsp?p=` as suspicious request patterns to correlate, with `run?c=echo%20GW_READY_OK`, `c=echo%20GW_READY_OK`, and `GW_READY_OK` called out as log and error indicators. Once the staged component is reachable, the `c=` parameter can be used to send operating system commands such as `whoami`, while `p=` may indicate file read behavior. + + This analytic story focuses on Windchill MethodServer log4j telemetry, especially the `wt.servlet.ServletRequestMonitor.request` and `wt.method.MethodContextMonitor.contexts.servletRequest` loggers, to identify exploitation probes and follow-on command or file read activity. Organizations should combine these detections with the PTC-published HTTP server mitigations, patching guidance, and file-system IOC checks for artifacts such as `GW.class`, `payload.bin`, and randomly named `dpr_<8 hex>.jsp` files. +references: + - https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability + - https://nvd.nist.gov/vuln/detail/CVE-2026-4681 + - https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-03 +cve: + - CVE-2026-4681 +category: + - Adversary Tactics +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Application Security From fad1a59f7aedbc60dd9b8f2e507d0b30b3d45326 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Mon, 15 Jun 2026 11:21:58 -0400 Subject: [PATCH 005/164] Add New BlueHammer / RedSun Analytics (#4037) --------- Co-authored-by: Nasreddine Bencherchali Co-authored-by: Bhavin Patel --- .../windows_event_log_security_4723.yml | 116 ++++++++++++++++++ ...ws_admin_password_changed_by_non_admin.yml | 70 +++++++++++ ...iles_filter_loaded_by_uncommon_process.yml | 79 ++++++++++++ ...lter_log_created_by_non_system_process.yml | 72 +++++++++++ .../windows_msmpeng_writing_to_system32.yml | 80 ++++++++++++ ...tem_process_querying_definition_update.yml | 75 +++++++++++ ...s_suspicious_burst_of_password_changes.yml | 90 ++++++++++++++ ...ld_process_of_tieringengineservice_exe.yml | 116 ++++++++++++++++++ ...nder_engine_or_signature_files_created.yml | 81 ++++++++++++ ..._defender_update_activity_in_inetcache.yml | 79 ++++++++++++ ...ssvc_process_accessing_defender_engine.yml | 76 ++++++++++++ lookups/csv/suspicious_named_pipes.csv | 1 + stories/bluehammer.yml | 22 ++++ stories/redsun.yml | 21 ++++ 14 files changed, 978 insertions(+) create mode 100644 data_sources/windows_event_log_security_4723.yml create mode 100644 detections/endpoint/windows_admin_password_changed_by_non_admin.yml create mode 100644 detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml create mode 100644 detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml create mode 100644 detections/endpoint/windows_msmpeng_writing_to_system32.yml create mode 100644 detections/endpoint/windows_non_system_process_querying_definition_update.yml create mode 100644 detections/endpoint/windows_suspicious_burst_of_password_changes.yml create mode 100644 detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml create mode 100644 detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml create mode 100644 detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml create mode 100644 detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml create mode 100644 stories/bluehammer.yml create mode 100644 stories/redsun.yml diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml new file mode 100644 index 0000000000..5105961915 --- /dev/null +++ b/data_sources/windows_event_log_security_4723.yml @@ -0,0 +1,116 @@ +name: Windows Event Log Security 4723 +id: df19b271-57c8-4f31-817a-6c5566985484 +version: 1 +creation_date: '2026-06-15' +modification_date: '2026-06-15' +author: Raven Tait, Splunk +description: Logs an event when an attempt is made to change an account's password, whether successful or not. +mitre_components: +- User Account Modification +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '4723' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 10.0.1 +fields: +- _time +- Caller_Domain +- Caller_User_Name +- CategoryString +- Channel +- Computer +- Error_Code +- EventCode +- EventData_Xml +- EventID +- EventRecordID +- Guid +- Keywords +- Level +- Logon_ID +- Name +- Opcode +- ProcessID +- RecordNumber +- SubjectDomainName +- SubjectLogonId +- SubjectUserName +- SubjectUserSid +- SystemTime +- System_Props_Xml +- TargetDomainName +- TargetSid +- TargetUserName +- Target_Domain +- Target_User_Name +- Task +- ThreadID +- Version +- action +- app +- change_type +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- dest +- dest_nt_domain +- dvc +- dvc_nt_host +- event_id +- eventtype +- host +- id +- index +- linecount +- name +- object +- object_attrs +- object_category +- object_id +- product +- punct +- result +- session_id +- signature +- signature_id +- source +- sourcetype +- splunk_server +- src_nt_domain +- src_user +- src_user_name +- status +- subject +- ta_windows_action +- ta_windows_security_CategoryString +- tag +- tag::eventtype +- timeendpos +- timestartpos +- user +- user_group +- user_name +- vendor +- vendor_product +output_fields: +- dest +example_log: + 472300138240 + 0x8010000000000000 + 781490 + Security + WIN10-21H1.strt.labs + AdministratorWIN10-21H1 + S-1-5-21-1538153195-943065003-848949206-500 + S-1-5-21-1538153195-943065003-848949206-1003bob + WIN10-21H10x61a292 + - diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml new file mode 100644 index 0000000000..9efa95ae5a --- /dev/null +++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml @@ -0,0 +1,70 @@ +name: Windows Admin Password Changed by Non-Admin +id: 6d4c4d88-cd60-43a1-8c70-c74a9614f724 +version: 1 +creation_date: '2026-04-27' +modification_date: '2026-04-27' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity. +data_source: + - Windows Event Log Security 4723 +search: |- + `wineventlog_security` + EventCode=4723 + | rex field=object_id "-(?\d+)$" + | rex field=SubjectUserSid "-(?\d+)$" + | where target_rid="500" OR tonumber(target_rid) IN (512,513,518,519,520) + | where tonumber(subject_rid) >= 1000 + | where SubjectUserSid != object_id + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user object_id EventCode src_user + SubjectUserSid SubjectLogonId PrivilegeList + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_admin_password_changed_by_non_admin_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some IT support tools or automated scripts may change administrator passwords during maintenance. Verify changes against authorized administrative activities to reduce false alerts. +references: + - https://github.com/Nightmare-Eclipse/BlueHammer +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +finding: + title: Non-Administrator account $src_user$ changed password of Admin account $user$ on $dest$. + entity: + field: dest + type: system + score: 50 +analytic_story: + - Windows Privilege Escalation + - BlueHammer +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1543.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +cve: + - CVE-2026-33825 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/bluehammer/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml new file mode 100644 index 0000000000..f15a399546 --- /dev/null +++ b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml @@ -0,0 +1,79 @@ +name: Windows Cloud Files Filter Loaded by Uncommon Process +id: 77b85062-274e-43a5-9dab-c25862b85291 +version: 1 +creation_date: '2026-05-18' +modification_date: '2026-05-18' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects cldapi.dll being loaded by a process not associated with legitimate cloud sync activity. + The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits. +data_source: + - Sysmon EventID 7 +search: |- + `sysmon` + EventID=7 + ImageLoaded="*\\cldapi.dll" + NOT Image IN ( + "*\\box.exe", + "*\\dropbox.exe", + "*\\googledrivefs.exe", + "*\\icloud.exe", + "*\\onedrive*.exe", + "*\\Windows\\explorer.exe" + "*\\Windows\\System32\\*", + "*\\Windows\\Syswow64\\*", + "*\\Windows\\WinSxS\\*" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec + process_guid process_hash process_id process_name process_path + service_dll_signature_exists service_dll_signature_verified signature_id user_id + vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_cloud_files_filter_loaded_by_uncommon_process_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: |- + False positives may include other third-party cloud-based file storage software. + Filter as necessary for your environment. +references: + - https://www.huntress.com/blog/nightmare-eclipse-intrusion + - https://www.threatlocker.com/blog/miniplasma-windows-privilege-escalation-zero-day-affects-fully-patched-systems +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Cloud Files Filter ($ImageLoaded$) loaded by suspicious process $Image$ on $dest$ +analytic_story: + - RedSun + - BlueHammer +asset_type: Endpoint +mitre_attack_id: + - T1543.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/redsun/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml b/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml new file mode 100644 index 0000000000..22f756fe00 --- /dev/null +++ b/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml @@ -0,0 +1,72 @@ +name: Windows Cloud Files Filter Log Created by Non-System Process +id: 2e0042b9-8a75-49ca-b3a2-948f04b752bf +version: 1 +creation_date: '2026-05-01' +modification_date: '2026-05-01' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + Detects a non-system process causing creation of CldFlt0.etl under C:\Windows\System32\LogFiles\CloudFiles\. + This path is initialised by the CldFlt driver when a process calls CfRegisterSyncRoot() or CfConnectSyncRoot(). + In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file. + Legitimate cloud providers (OneDrive etc.) register sync roots from SYSTEM-level service processes, not from user-context executables. +data_source: + - Sysmon EventID 11 +search: |- + `sysmon` + EventCode=11 + TargetFilename = "*\\Windows\\System32\\LogFiles\\CloudFiles\\*" + NOT Image IN ( + "*:\\Windows\\System32*", + "*:\\Windows\\SysWOW64*", + "*:\\Program Files\\WindowsApps\\*" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + by action dest file_name file_path Image process_guid + process_id user_id vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_cloud_files_filter_log_created_by_non_system_process_filter` +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: No false positives have been identified at this time. +references: + - https://github.com/Nightmare-Eclipse/RedSun + - https://www.huntress.com/blog/nightmare-eclipse-intrusion +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Non-System process $Image$ created a cloud files filter $file_name$ on host $dest$ + entity: + field: dest + type: system + score: 50 +analytic_story: + - RedSun + - Windows Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +cve: + - CVE-2026-33825 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/redsun/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_msmpeng_writing_to_system32.yml b/detections/endpoint/windows_msmpeng_writing_to_system32.yml new file mode 100644 index 0000000000..77a9276794 --- /dev/null +++ b/detections/endpoint/windows_msmpeng_writing_to_system32.yml @@ -0,0 +1,80 @@ +name: Windows MsMpEng Writing to System32 +id: dc615235-1241-411a-b170-b34a4c8924aa +version: 1 +creation_date: '2026-04-27' +modification_date: '2026-04-27' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + Detects MsMpEng.exe creating a file in C:\\Windows\\System32\\. + This should never happen under normal operation Windows Defender does not install kernel drivers at runtime. + In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker's driver payload directly into the drivers directory. +data_source: + - Sysmon EventID 15 + - Sysmon EventID 11 +search: |- + `sysmon` + (EventID=15 OR EventID=11) + Image="*\\MsMpEng.exe" + TargetFilename="*:\\Windows\\System32\\*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by Computer Image TargetFilename EventID dest dvc + file_hash file_name file_path action process_exec + process_guid process_id process_name process_path + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_msmpeng_writing_to_system32_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + No false positives have been identified at this time. +references: + - https://github.com/Nightmare-Eclipse/BlueHammer +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +finding: + title: $Image$ wrote a File or an Alternate Data Stream $TargetFilename$ on $dest$. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: Image + type: process + - field: TargetFilename + type: file_path +analytic_story: + - Windows Drivers + - Windows Privilege Escalation + - BlueHammer + - RedSun +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1543.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +cve: + - CVE-2026-33825 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/bluehammer/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml new file mode 100644 index 0000000000..3a889d8d33 --- /dev/null +++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml @@ -0,0 +1,75 @@ +name: Windows Non-System Process Querying Definition Update +id: 9d375cfd-c9a5-48ff-b875-9bcaf6b63265 +version: 1 +creation_date: '2026-04-27' +modification_date: '2026-04-27' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain. +data_source: + - Sysmon EventID 22 +search: |- + `sysmon` + EventID="22" + QueryName="*definitionupdates.microsoft.com*" + NOT Image IN ( + "*:\\Program Files\\Microsoft Office\\*", + "*:\\Program Files\\Windows Defender\\*", + "*:\\ProgramData\\Microsoft\\Windows Defender\\*", + "*:\\Windows\\System32\\*", + "*:\\Windows\\SysWOW64\\*" + ) + | stats count min(_time) as firstTime max(_time) as lastTime BY answer answer_count dvc Computer process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | rename Computer as dest + | `windows_non_system_process_querying_definition_update_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate third-party applications or security tools may query these update domains for Windows Defender updates. Filter alerts for trusted software and verified update mechanisms. +references: + - https://github.com/Nightmare-Eclipse/BlueHammer +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Non-System process $Image$ queried Windows Defender Definition Updates domain $QueryName$ on $dest$. +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Windows Privilege Escalation + - BlueHammer + - RedSun +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1071.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +cve: + - CVE-2026-33825 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/bluehammer/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml new file mode 100644 index 0000000000..84fc995ac6 --- /dev/null +++ b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml @@ -0,0 +1,90 @@ +name: Windows Suspicious Burst of Password Changes +id: 0dcfcab9-e936-43bc-8203-005e17dc0744 +version: 1 +creation_date: '2026-04-29' +modification_date: '2026-04-29' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window. + This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously. +data_source: + - Windows Event Log Security 4723 + - Windows Event Log Security 4724 +search: |- + `wineventlog_security` + ( + EventCode=4723 + OR + EventCode=4724 + ) + | eval log_time = strptime(SystemTime, "%Y-%m-%dT%H:%M:%S.%6NZ") + | eval log_time = coalesce(log_time, _time) + | eval time_bucket = floor(log_time / 2) * 2 + | eval SubjectRID = tonumber(replace(SubjectUserSid, ".*-(\d+)$", "\1")) + | where SubjectRID >= 1000 + | stats count AS EventsForAccount + min(log_time) AS firstTime + max(log_time) AS lastTime + by Computer TargetUserName SubjectUserName time_bucket + + | where EventsForAccount >= 4 + | eval DurationSecs = round(lastTime - firstTime, 3), DurationSecs = if(DurationSecs = 0, 0.001, DurationSecs), ChangeRatePerSec = round(EventsForAccount / DurationSecs, 2) + | rename Computer as dest + + | stats dc(TargetUserName) AS AffectedAccounts + values(TargetUserName) AS Accounts + values(SubjectUserName) AS InitiatingAccounts + sum(EventsForAccount) AS TotalEvents + max(ChangeRatePerSec) AS PeakChangeRatePerSec + min(DurationSecs) AS FastestBurstSecs + min(firstTime) AS firstTime + max(lastTime) AS lastTime + by dest time_bucket + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_burst_of_password_changes_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting EventID 4723 and EventID 4724 events with the Windows TA. +known_false_positives: |- + Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed. +references: + - https://github.com/Nightmare-Eclipse/BlueHammer +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +finding: + title: Rapid burst of password changes of local accounts by $SubjectUserName$ on $dest$ + entity: + field: dest + type: system + score: 20 +analytic_story: + - Windows Privilege Escalation + - BlueHammer +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +cve: + - CVE-2026-33825 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/bluehammer/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml b/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml new file mode 100644 index 0000000000..887533c621 --- /dev/null +++ b/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml @@ -0,0 +1,116 @@ +name: Windows Suspicious Child Process of TieringEngineService.exe +id: 69edec6c-877e-4423-9b9b-025b589123a8 +version: 1 +creation_date: '2026-05-01' +modification_date: '2026-05-01' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session. + RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: | + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.parent_process_name="TieringEngineService.exe" + ( + Processes.process IN ( + "*bitsadmin.exe*", + "*cmd.exe*", + "*conhost.exe*", + "*cscript.exe*", + "*curl.exe*", + "*powershell.exe*", + "*pwsh.exe*", + "*rundll32.exe*", + "*wmic.exe*" + ) + OR + Processes.process_name IN ( + "bitsadmin.exe", + "cmd.exe", + "conhost.exe", + "cscript.exe", + "curl.exe", + "powershell.exe", + "pwsh.exe", + "rundll32.exe", + "wmic.exe" + ) + ) + Processes.user IN ( + "*AUTHORITY*", + "*System*" + ) + + BY Processes.dest Processes.user Processes.original_file_name + Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id + Processes.parent_process_name action + parent_process_exec parent_process_guid + parent_process_path process_exec process_guid + process_hash process_integrity_level + process_path user_id vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_child_process_of_tieringengineservice_exe_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + No false positives have been identified at this time. +references: + - https://github.com/Nightmare-Eclipse/RedSun + - https://www.huntress.com/blog/nightmare-eclipse-intrusion +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Possible suspicious child process $process_path$ spawned from $parent_process_path$ on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process + type: process + - field: process_name + type: process_name +analytic_story: + - RedSun + - Windows Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +cve: + - CVE-2026-33825 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/redsun/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml b/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml new file mode 100644 index 0000000000..a7c5c40ed2 --- /dev/null +++ b/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml @@ -0,0 +1,81 @@ +name: Windows Suspicious Defender Engine or Signature Files Created +id: 42e848eb-1d5f-4ffb-88c2-088c4a6fdfb3 +version: 1 +creation_date: '2026-04-27' +modification_date: '2026-04-27' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + Detects Windows Defender engine (mpengine.dll) or signature database files (*.vdm) being created by any process that is not a Windows Defender component. + BlueHammer extracts these files from the downloaded mpam-fe update package into a UUID-named subdirectory of %TEMP% as part of staging the TOCTOU privilege escalation. +data_source: + - Sysmon EventID 11 +search: |- + `sysmon` EventID="11" + TargetFilename IN ( + "*\\mpasbase.vdm*", + "*\\mpasdlta.vdm*", + "*\\mpavbase.vdm*", + "*\\mpavdlta.vdm*", + "*\\mpengine.dll*" + ) + NOT Image IN ( + "*:\\ProgramData\\Microsoft\\Windows Defender\\*", + "*:\\Program Files\\Windows Defender\\*" + ) + | fillnull + | rename Computer as dest + | stats count by dest TargetFilename Image EventID + action file_name file_path process_guid + process_id user vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_defender_engine_or_signature_files_created_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some legitimate software updates or security tools may create Windows Defender engine or signature files in user temp folders during scanning or updating processes. + Filter detections for trusted update utilities and system maintenance tasks. +references: + - https://github.com/Nightmare-Eclipse/BlueHammer +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Windows Defender Engine or Signature file $file_path$ created by Non-Defender Process $Image$ on $dest$. +threat_objects: + - field: Image + type: process +analytic_story: + - Windows Privilege Escalation + - BlueHammer +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +cve: + - CVE-2026-33825 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/bluehammer/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml new file mode 100644 index 0000000000..aaf60e32cd --- /dev/null +++ b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml @@ -0,0 +1,79 @@ +name: Windows Suspicious Defender Update Activity in INetCache +id: 3e25f906-6319-44ad-ab9a-22d162eb3925 +version: 1 +creation_date: '2026-04-27' +modification_date: '2026-04-27' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + Detects a non-Defender process writing mpam-fe*.exe to the Windows Internet Cache (INetCache). + BlueHammer downloads the WD signature update package directly using WinINet as a low-privileged user. + The [1].exe naming suffix is produced by Windows HTTP caching and is a reliable artifact of this download method. +data_source: + - Sysmon EventID 11 + - Sysmon EventID 23 +search: |- + `sysmon` + EventID IN ("11","23") + TargetFilename="*\\INetCache*" + TargetFilename="*\\mpam-fe[1].exe*" + NOT Image IN ( + "*:\\Program Files\\Windows Defender*", + "*:\\ProgramData\\Microsoft\\Windows Defender*", + "*:\\Windows\\System32\\MpSigStub.exe*" + ) + | fillnull + | rename Computer as dest + | stats count by dest TargetFilename Image EventID + action file_name file_path process_guid + process_id user vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_defender_update_activity_in_inetcache_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some legitimate system maintenance tools or security scanners may download updates using WinINet and write to INetCache with similar naming patterns. Filter alerts when these tools are verified and approved. +references: + - https://github.com/Nightmare-Eclipse/BlueHammer +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Defender Update package $file_path$ downloaded to INetCache by unexpected process $Image$ on $dest$. +threat_objects: + - field: Image + type: process +analytic_story: + - Windows Persistence Techniques + - BlueHammer +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1105 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +cve: + - CVE-2026-33825 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/bluehammer/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml b/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml new file mode 100644 index 0000000000..6885fd4a79 --- /dev/null +++ b/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml @@ -0,0 +1,76 @@ +name: Windows VSSVC Process Accessing Defender Engine +id: 0c398be7-e33a-4882-9546-12166ceaf73c +version: 1 +creation_date: '2026-05-01' +modification_date: '2026-05-01' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + Detects vssvc.exe opening a handle to MsMpEng.exe. + In the RedSun exploit, VSS participates in the cloud-file restore race that directs WD to write through the NTFS junction. + This handle acquisition is observed at the exact moment of exploitation. + vssvc querying MsMpEng is not expected in normal operation. +data_source: + - Sysmon EventID 10 +search: |- + `sysmon` + EventCode=10 + TargetImage="*\\MsMpEng.exe" + SourceImage="*\\vssvc.exe" + | stats count min(_time) as firstTime + max(_time) as lastTime + by EventID GrantedAccess Guid Opcode ProcessID + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + UserID dest CallTrace user_id parent_process_name + parent_process_guid process_name + process_guid process_id signature + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_vssvc_process_accessing_defender_engine_filter` +how_to_implement: |- + This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. + This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. + Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. +known_false_positives: |- + No false positives have been identified at this time. +references: + - https://github.com/Nightmare-Eclipse/RedSun + - https://www.huntress.com/blog/nightmare-eclipse-intrusion +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Windows Process $SourceImage$ accessing $TargetImage$ on $dest$ + entity: + field: dest + type: system + score: 50 +analytic_story: + - RedSun + - Windows Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +cve: + - CVE-2026-33825 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/redsun/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/lookups/csv/suspicious_named_pipes.csv b/lookups/csv/suspicious_named_pipes.csv index cc0b5f22eb..39e4d1ad97 100644 --- a/lookups/csv/suspicious_named_pipes.csv +++ b/lookups/csv/suspicious_named_pipes.csv @@ -70,6 +70,7 @@ suspicious_pipe_name,tool,description,type *\pipey,RpcSsImpersonator,faxhell / printjacker / RpcSsImpersonator - Elevation to SYSTEM,Privilege Escalation *\PrivFuPipe*,PrivFu,Privilege escalation PoCs,Privilege Escalation *\protected_storage,impacket,impacket dcerpc pipe name,Credential Access +*\REDSUN,RedSun, RedSun privilege escalation PoCs,Privilege Escalation *\RemCom_Commuincation,Remcom,Remote execution like PsExec,Lateral Movement *\remcom*,Remcom,Remote execution like PsExec,Lateral Movement *\RemoteMaint,impacketremoteshell,impacketremoteshell default pipe name,Lateral Movement diff --git a/stories/bluehammer.yml b/stories/bluehammer.yml new file mode 100644 index 0000000000..8fd16479a5 --- /dev/null +++ b/stories/bluehammer.yml @@ -0,0 +1,22 @@ +name: BlueHammer +id: 9e2f91be-796f-4363-8c6f-a6d5dbdaede6 +version: 1 +status: production +creation_date: '2026-04-29' +modification_date: '2026-04-29' +author: Raven Tait, Splunk +description: Detect activity associated with BlueHammer exploit. Released by Nightmare-Eclipse on GitHub alongside RedSun and UnDefend, it is part of a set of attacks that abuse Windows Defender to disrupt the system or elevate privileges. +narrative: BlueHammer is a Windows local privilege escalation (LPE) exploit that allows a threat actor who already has a foothold on a system to elevate from a low-privileged user account to full SYSTEM-level control. It abuses the Windows Defender update process via Volume Shadow Copy, using Cloud Files callbacks and oplocks to pause Defender at a critical moment — exposing the SAM, SYSTEM, and SECURITY registry hives. This enables an attacker to read the SAM database, decrypt NTLM password hashes, take over a local administrator account, and spawn a SYSTEM-level shell, while restoring the original hash to avoid detection. +references: +- https://github.com/Nightmare-Eclipse/BlueHammer +- http://huntress.com/blog/nightmare-eclipse-intrusion +- https://www.picussecurity.com/resource/blog/bluehammer-redsun-windows-defender-cve-2026-33825-zero-day-vulnerability-explained +category: +- Adversary Tactics +product: +- Splunk Enterprise +- Splunk Enterprise Security +- Splunk Cloud +usecase: Advanced Threat Detection +cve: +- CVE-2026-33825 diff --git a/stories/redsun.yml b/stories/redsun.yml new file mode 100644 index 0000000000..c564554e88 --- /dev/null +++ b/stories/redsun.yml @@ -0,0 +1,21 @@ +name: RedSun +id: fa31fe1f-ddad-4238-b438-2b7741b7cf34 +version: 1 +status: production +creation_date: '2026-04-29' +modification_date: '2026-04-29' +author: Raven Tait, Splunk +description: Detect activity associated with RedSun exploit. Released by Nightmare-Eclipse on GitHub alongside BlueHammer and UnDefend, it is part of a set of attacks that abuse Windows Defender to disrupt the system or elevate privileges. +narrative: RedSun is a zero-day LPE vulnerability in Microsoft Defender that allows a low-privileged user to gain full NT AUTHORITY\SYSTEM access without any kernel exploit or administrator interaction. It abuses a logic flaw in how Defender handles cloud-tagged files during remediation — when Defender detects a malicious file carrying a cloud tag, it attempts to restore the file to its original location rather than quarantine it, running that restore operation with full SYSTEM privileges without validating whether the target path has been tampered with. An attacker redirects that write via an NTFS junction into C:\Windows\System32, dropping an attacker-controlled binary and executing it as SYSTEM through a COM service invocation — never touching credentials. +references: +- https://github.com/Nightmare-Eclipse/RedSun +- https://www.huntress.com/blog/nightmare-eclipse-intrusion +category: +- Adversary Tactics +product: +- Splunk Enterprise +- Splunk Enterprise Security +- Splunk Cloud +usecase: Advanced Threat Detection +cve: +- CVE-2026-33825 From a1136e42c6c765db7fecc5926af80594655f789b Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Tue, 16 Jun 2026 09:23:24 +0200 Subject: [PATCH 006/164] 2026-20127 (#4119) * 2026-20127 * 2026-20127 * 2026-20127 * 2026-20127 * update metadata --------- Co-authored-by: Teoderick Contreras Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: Bhavin Patel Co-authored-by: Nasreddine Bencherchali --- data_sources/cisco_sd_wan_auth_log.yml | 14 +++++ ...ce_ip_vmanage_admin_ssh_authentication.yml | 53 +++++++++++++++++++ ...sh_key_authentication_from_same_source.yml | 49 +++++++++++++++++ 3 files changed, 116 insertions(+) create mode 100644 data_sources/cisco_sd_wan_auth_log.yml create mode 100644 detections/application/cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml create mode 100644 detections/application/cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml diff --git a/data_sources/cisco_sd_wan_auth_log.yml b/data_sources/cisco_sd_wan_auth_log.yml new file mode 100644 index 0000000000..eeed82261e --- /dev/null +++ b/data_sources/cisco_sd_wan_auth_log.yml @@ -0,0 +1,14 @@ +name: Cisco SD-WAN Auth Log +id: a7c9ec91-85cb-44fc-be26-e652ba7e4127 +version: 1 +creation_date: '2026-06-09' +modification_date: '2026-06-09' +author: Teoderick Contreras, Splunk +description: Data source object for Cisco SD-WAN Auth logs +source: /var/log/auth.log +sourcetype: cisco:sdwan:syslog +supported_TA: [] +fields: + - _time + - _raw +example_log: '2026-03-30T05:29:57+00:00 vsmart sshd[20244]: Accepted publickey for vmanage-admin from 172.161.255.29 port 37146 ssh2: RSA SHA256:KEY_2' diff --git a/detections/application/cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml b/detections/application/cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml new file mode 100644 index 0000000000..25e26749f6 --- /dev/null +++ b/detections/application/cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml @@ -0,0 +1,53 @@ +name: Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication +id: 7882ec59-0e5b-4899-bd1a-7f9b16078bd4 +version: 1 +creation_date: '2026-06-09' +modification_date: '2026-06-09' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: |- + This analytic identifies multiple unique source IP addresses successfully authenticating as `vmanage-admin` via SSH publickey on Cisco Catalyst SD-WAN control components within a short time window. + This aligns with IoC guidance for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk), which warns that compromised systems may show `Accepted publickey for vmanage-admin` entries from unauthorized IPs. + Validate flagged source IPs against known System IPs in SD-WAN Manager and investigate unexpected or concurrent sources. +data_source: + - Cisco SD-WAN Auth Log +search: |- + `cisco_sd_wan_syslog` + "Accepted publickey" + | rex field=_raw "^(?\S+)\s+(?\S+)\s+\s+sshd\[\d+\]:\s+Accepted publickey for (?\S+) from (?\S+) port (?\d+) ssh2:\s+(?\S+)\s+(?\S+)" + | where user="vmanage-admin" + | bin event_timestamp span=2m + | stats dc(src) as unique_src_ips + values(src) as src_ips + values(user) as users + count as auth_count by event_timestamp dest + | where unique_src_ips >= 2 + | sort 0 - unique_src_ips + | `cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication_filter` +how_to_implement: | + This detection requires Cisco SD-WAN auth logs from the /var/log/auth.log file to be ingested into Splunk. +known_false_positives: | + No false positives have been identified at this time. +references: + - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk +analytic_story: + - Cisco Catalyst SD-WAN Analytics +asset_type: Network +cve: + - CVE-2026-20127 +mitre_attack_id: + - T1595 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/CVE-2026-20127/auth_dummy_key.log + source: /var/log/auth.log + sourcetype: cisco:sdwan:syslog + test_type: unit diff --git a/detections/application/cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml b/detections/application/cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml new file mode 100644 index 0000000000..eb0575379d --- /dev/null +++ b/detections/application/cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml @@ -0,0 +1,49 @@ +name: Cisco SD-WAN Multiple SSH key Authentication from Same Source +id: 23e15133-d825-4e1d-b885-b8fe3909e947 +version: 1 +creation_date: '2026-06-09' +modification_date: '2026-06-09' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: |- + This hunting analytic identifies multiple distinct SSH publickey fingerprints used to authenticate the same user from the same source IP against a Cisco Catalyst SD-WAN control component. + After legitimate vManage key rotation or reboot, a new key may appear but the old key should no longer be used; continued use of more than one key from the same source may indicate unauthorized key injection or persistence related to CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk). + Validate flagged keys and source IPs against known System IPs in SD-WAN Manager and investigate unexpected combinations. +data_source: + - Cisco SD-WAN Auth Log +search: |- + `cisco_sd_wan_syslog` + "Accepted publickey" + | rex field=_raw "^(?\S+)\s+(?\S+)\s+\s+sshd\[\d+\]:\s+Accepted publickey for (?\S+) from (?\S+) port (?\d+) ssh2:\s+(?\S+)\s+(?\S+)" + | stats dc(ssh_key) as distinct_keys + values(ssh_key) as ssh_keys + count by dest user src + | where distinct_keys > 1 + | `cisco_sd_wan_multiple_ssh_key_authentication_from_same_source_filter` +how_to_implement: | + This detection requires Cisco SD-WAN auth logs from the /var/log/auth.log file to be ingested into Splunk. +known_false_positives: | + No false positives have been identified at this time. +references: + - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk +analytic_story: + - Cisco Catalyst SD-WAN Analytics +asset_type: Network +cve: + - CVE-2026-20127 +mitre_attack_id: + - T1595 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/CVE-2026-20127/auth_dummy_key.log + source: /var/log/auth.log + sourcetype: cisco:sdwan:syslog + test_type: unit From efd02f448d66bd1ea509a36722c477f2b743b737 Mon Sep 17 00:00:00 2001 From: David Sarkisyan Date: Tue, 16 Jun 2026 03:31:00 -0400 Subject: [PATCH 007/164] Fix broken regex alternation in detections (#4116) * Fix broken regex alternation in detections * Update linux_proxy_socks_curl.yml * revert since they are covered in #4107 * update --------- Co-authored-by: David Sarkisyan <281478990+srkyn@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: Bhavin Patel --- ...copilot_impersonation_jailbreak_attack.yml | 14 +- ...connect_to_internet_with_hidden_window.yml | 16 +- .../endpoint/linux_proxy_socks_curl.yml | 45 ++-- .../endpoint/powershell_4104_hunting.yml | 209 +++--------------- 4 files changed, 69 insertions(+), 215 deletions(-) rename detections/{endpoint => deprecated}/powershell___connect_to_internet_with_hidden_window.yml (92%) diff --git a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml index c18d6af649..cba621255a 100644 --- a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml +++ b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml @@ -1,8 +1,8 @@ name: M365 Copilot Impersonation Jailbreak Attack id: cc26aba8-7f4a-4078-b91a-052d6a53cb13 -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-06-04' author: Rod Soto status: experimental type: TTP @@ -13,15 +13,7 @@ search: |- `m365_exported_ediscovery_prompt_logs` | search Subject_Title="*Pretend you are*" OR Subject_Title="*act as*" OR Subject_Title="*you are now*" OR Subject_Title="*amoral*" OR Subject_Title="*being*" OR Subject_Title="*roleplay as*" OR Subject_Title="*imagine you are*" OR Subject_Title="*behave like*" | eval user = Sender - | eval impersonation_type=case(match(Subject_Title, "(?i)pretend you are.*AI"), "AI_Impersonation", match(Subject_Title, "(?i)(act as - | roleplay as).*AI"), "AI_Roleplay", match(Subject_Title, "(?i)amoral.*AI"), "Amoral_AI", match(Subject_Title, "(?i)transcendent being"), "Fictional_Entity", match(Subject_Title, "(?i)(act as - | pretend you are).*(entities - | multiple)"), "Multi_Entity", match(Subject_Title, "(?i)(imagine you are - | behave like).*AI"), "AI_Behavioral_Change", match(Subject_Title, "(?i)you are now.*AI"), "AI_Identity_Override", match(Subject_Title, "(?i)(evil - | malicious - | harmful).*AI"), "Malicious_AI_Persona", match(Subject_Title, "(?i)(unrestricted - | unlimited - | uncensored).*AI"), "Unrestricted_AI_Persona", 1=1, "Generic_Roleplay") + | eval impersonation_type=case(match(Subject_Title, "(?i)pretend you are.*AI"), "AI_Impersonation", match(Subject_Title, "(?i)(act as|roleplay as).*AI"), "AI_Roleplay", match(Subject_Title, "(?i)amoral.*AI"), "Amoral_AI", match(Subject_Title, "(?i)transcendent being"), "Fictional_Entity", match(Subject_Title, "(?i)(act as|pretend you are).*(entities|multiple)"), "Multi_Entity", match(Subject_Title, "(?i)(imagine you are|behave like).*AI"), "AI_Behavioral_Change", match(Subject_Title, "(?i)you are now.*AI"), "AI_Identity_Override", match(Subject_Title, "(?i)(evil|malicious|harmful).*AI"), "Malicious_AI_Persona", match(Subject_Title, "(?i)(unrestricted|unlimited|uncensored).*AI"), "Unrestricted_AI_Persona", 1=1, "Generic_Roleplay") | table _time, user, Subject_Title, impersonation_type, Workload | sort -_time | `m365_copilot_impersonation_jailbreak_attack_filter` diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml similarity index 92% rename from detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml rename to detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml index a18f6adf36..1d49d65adb 100644 --- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ b/detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml @@ -1,10 +1,10 @@ name: PowerShell - Connect To Internet With Hidden Window id: ee18ed37-0802-4268-9435-b3b91aaa18db -version: 16 +version: 17 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-06-04' author: David Dorsey, Michael Haag Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects PowerShell commands using the WindowStyle parameter to hide the window while connecting to the Internet. This behavior is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions that include variations of the WindowStyle parameter. This activity is significant because it attempts to bypass default PowerShell execution policies and conceal its actions, which is often indicative of malicious intent. If confirmed malicious, this could allow an attacker to execute commands stealthily, potentially leading to unauthorized data exfiltration or further compromise of the endpoint. data_source: @@ -24,11 +24,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | where match(process,"(?i)[\- - | \/ - | – - | — - | ―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") + | where match(process,"(?i)[\-\/–—―|\u2013|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") | `powershell___connect_to_internet_with_hidden_window_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Legitimate process can have this combination of command-line options, but it's not common. @@ -64,3 +60,7 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection has been deprecated due to incorrect logic and bad performance. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml index d696c06bd8..4b90b345f6 100644 --- a/detections/endpoint/linux_proxy_socks_curl.yml +++ b/detections/endpoint/linux_proxy_socks_curl.yml @@ -1,29 +1,46 @@ name: Linux Proxy Socks Curl id: bd596c22-ad1e-44fc-b242-817253ce8b08 -version: 13 +version: 14 creation_date: '2022-07-29' -modification_date: '2026-05-13' +modification_date: '2026-06-04' author: Michael Haag, Splunk, 0xC0FFEEEE, Github Community status: production type: TTP -description: The following analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as it may indicate an adversary attempting to use a proxy to evade network monitoring and obscure their actions. If confirmed malicious, this behavior could allow attackers to bypass security controls, making it difficult to track their activities and potentially leading to unauthorized data access or exfiltration. +description: |- + The following analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`. + This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. + This activity is significant as it may indicate an adversary attempting to use a proxy to evade network monitoring and obscure their actions. + If confirmed malicious, this behavior could allow attackers to bypass security controls, making it difficult to track their activities and potentially leading to unauthorized data access or exfiltration. data_source: - Sysmon for Linux EventID 1 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=curl Processes.process IN ("*-x *", "*socks4a://*", "*socks5h://*", "*socks4://*","*socks5://*", "*--preproxy *", "--proxy*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name=curl + Processes.process IN ( + "*--preproxy *", + "*--proxy*", + "*-x *", + "*socks4://*", + "*socks4a://*", + "*socks5://*", + "*socks5h://*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | where match(process, "-x\s") OR match(process, "(?i)socks\d\w?:\/\/ - | --(pre)?proxy") + | where match(process, "-x\s") OR match(process, "(?i)(socks\d\w?:\/\/|--(pre)?proxy)") | `linux_proxy_socks_curl_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: False positives may be present based on proxy usage internally. Filter as needed. diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 9c45449160..72d9d32868 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,194 +1,39 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 25 +version: 26 creation_date: '2021-08-19' -modification_date: '2026-05-13' +modification_date: '2026-06-04' author: Michael Haag, Splunk status: production type: Hunting -description: The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security. +description: |- + The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. + If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 - | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0) - | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4} - | [A-Za-z0-9+\/]{3}= - | [A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) - | eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration - | Add-Persistence - | Add-RegBackdoor - | Add-ScrnSaveBackdoor - | Check-VM - | Do-Exfiltration - | Enabled-DuplicateToken - | Exploit-Jboss - | Find-Fruit - | Find-GPOLocation - | Find-TrustedDocuments - | Get-ApplicationHost - | Get-ChromeDump - | Get-ClipboardContents - | Get-FoxDump - | Get-GPPPassword - | Get-IndexedItem - | Get-Keystrokes - | LSASecret - | Get-PassHash - | Get-RegAlwaysInstallElevated - | Get-RegAutoLogon - | Get-RickAstley - | Get-Screenshot - | Get-SecurityPackages - | Get-ServiceFilePermission - | Get-ServicePermission - | Get-ServiceUnquoted - | Get-SiteListPassword - | Get-System - | Get-TimedScreenshot - | Get-UnattendedInstallFile - | Get-Unconstrained - | Get-VaultCredential - | Get-VulnAutoRun - | Get-VulnSchTask - | Gupt-Backdoor - | HTTP-Login - | Install-SSP - | Install-ServiceBinary - | Invoke-ACLScanner - | Invoke-ADSBackdoor - | Invoke-ARPScan - | Invoke-AllChecks - | Invoke-BackdoorLNK - | Invoke-BypassUAC - | Invoke-CredentialInjection - | Invoke-DCSync - | Invoke-DllInjection - | Invoke-DowngradeAccount - | Invoke-EgressCheck - | Invoke-Inveigh - | Invoke-InveighRelay - | Invoke-Mimikittenz - | Invoke-NetRipper - | Invoke-NinjaCopy - | Invoke-PSInject - | Invoke-Paranoia - | Invoke-PortScan - | Invoke-PoshRat - | Invoke-PostExfil - | Invoke-PowerDump - | Invoke-PowerShellTCP - | Invoke-PsExec - | Invoke-PsUaCme - | Invoke-ReflectivePEInjection - | Invoke-ReverseDNSLookup - | Invoke-RunAs - | Invoke-SMBScanner - | Invoke-SSHCommand - | Invoke-Service - | Invoke-Shellcode - | Invoke-Tater - | Invoke-ThunderStruck - | Invoke-Token - | Invoke-UserHunter - | Invoke-VoiceTroll - | Invoke-WScriptBypassUAC - | Invoke-WinEnum - | MailRaider - | New-HoneyHash - | Out-Minidump - | Port-Scan - | PowerBreach - | PowerUp - | PowerView - | Remove-Update - | Set-MacAttribute - | Set-Wallpaper - | Show-TargetScreen - | Start-CaptureServer - | VolumeShadowCopyTools - | NEEEEWWW - | (Computer - | User)Property - | CachedRDPConnection - | get-net\S+ - | invoke-\S+hunter - | Install-Service - | get-\S+(credent - | password) - | remoteps - | Kerberos.*(policy - | ticket) - | netfirewall - | Uninstall-Windows - | Verb\s+Runas - | AmsiBypass - | nishang - | Invoke-Interceptor - | EXEonRemote - | NetworkRelay - | PowerShelludp - | PowerShellIcmp - | CreateShortcut - | copy-vss - | invoke-dll - | invoke-mass - | out-shortcut - | Invoke-ShellCommand"),1,0) - | eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0) - | eval empire=if(match(lower(ScriptBlockText),"system.net.webclient") AND match(lower(ScriptBlockText), "frombase64string") ,5,0) - | eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz") OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden") ,5,0) - | eval iex=if(match(ScriptBlockText, "(?i)iex - | invoke-expression"),2,0) - | eval webclient=if(match(lower(ScriptBlockText),"http") OR match(lower(ScriptBlockText),"web(client - | request)") OR match(lower(ScriptBlockText),"socket") OR match(lower(ScriptBlockText),"download(file - | string)") OR match(lower(ScriptBlockText),"bitstransfer") OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0) - | eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0) - | eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"), "4", 0) - | eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer - | mimik - | metasp - | AssemblyBuilderAccess - | Reflection\.Assembly - | shellcode - | injection - | cnvert - | shell\.application - | start-process - | Rc4ByteStream - | System\.Security\.Cryptography - | lsass\.exe - | localadmin - | LastLoggedOn - | hijack - | BackupPrivilege - | ngrok - | comsvcs - | backdoor - | brute.?force - | Port.?Scan - | Exfiltration - | exploit - | DisableRealtimeMonitoring - | beacon)"),1,0) - | eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0) - | eval httplocal = if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0) - | eval reflection = if(match(lower(ScriptBlockText),"reflection"), "1", 0) - | eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject - | WMIMethod - | RemoteWMI - | PowerShellWmi - | wmicommand)"),5,0) - | eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell -version"),3,0) - | eval compressed=if(match(ScriptBlockText, "(?i)GZipStream - | ::Decompress - | IO.Compression - | write-zip - | (expand - | compress)-Archive"),5,0) - | eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) - | addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get - | stats values(Score) + `powershell` + EventCode=4104 + | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0) + | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) + | eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) + | eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0) + | eval empire=if(match(lower(ScriptBlockText),"system.net.webclient") AND match(lower(ScriptBlockText), "frombase64string") ,5,0) + | eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz") OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden") ,5,0) + | eval iex=if(match(ScriptBlockText, "(?i)iex|invoke-expression"),2,0) + | eval webclient=if(match(lower(ScriptBlockText),"http") OR match(lower(ScriptBlockText),"web(client|request)") OR match(lower(ScriptBlockText),"socket") OR match(lower(ScriptBlockText),"download(file|string)") OR match(lower(ScriptBlockText),"bitstransfer") OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0) + | eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0) + | eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"), "4", 0) + | eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0) + | eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0) + | eval httplocal = if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0) + | eval reflection = if(match(lower(ScriptBlockText),"reflection"), "1", 0) + | eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0) + | eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell -version"),3,0) + | eval compressed=if(match(ScriptBlockText, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0) + | eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) + | addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get + | stats values(Score) BY UserID, Computer, DoIt, enccom, compressed, downgrade, iex, mimikatz, rundll32, From fe5b1812ee031334a527b3210d8dfb7c263826a5 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Tue, 16 Jun 2026 09:44:18 +0200 Subject: [PATCH 008/164] new_salat_stealer (#4118) * new_salat_stealer * new_salat_stealer * new_salat_stealer * new_salat_stealer --------- Co-authored-by: Teoderick Contreras Co-authored-by: Nasreddine Bencherchali Co-authored-by: Bhavin Patel Co-authored-by: Nasreddine Bencherchali --- .../add_or_set_windows_defender_exclusion.yml | 5 +- .../disable_defender_antivirus_registry.yml | 19 ++++- ...efender_submit_samples_consent_feature.yml | 19 ++++- .../disable_windows_behavior_monitoring.yml | 24 +++++- ...disable_windows_smartscreen_protection.yml | 16 +++- ...tables_or_script_creation_in_temp_path.yml | 5 +- .../firewall_allowed_program_enable.yml | 5 +- ...e_process_accessing_chrome_default_dir.yml | 5 +- ...fox_process_access_firefox_profile_dir.yml | 5 +- .../endpoint/powershell_4104_hunting.yml | 3 +- ...l_defender_threat_actions_set_to_allow.yml | 79 ++++++++++++++++++ ...powershell_disable_security_monitoring.yml | 5 +- ...script_contains_base64_encoded_content.yml | 5 +- .../powershell_processing_stream_of_data.yml | 5 +- ...wershell_using_memory_as_backing_store.yml | 5 +- ...ll_windows_defender_exclusion_commands.yml | 5 +- .../registry_keys_used_for_persistence.yml | 5 +- ...ss_token_manipulation_sedebugprivilege.yml | 5 +- ...ial_access_from_browser_password_store.yml | 5 +- ...ssword_stores_chrome_localstate_access.yml | 5 +- ...ssword_stores_chrome_login_data_access.yml | 5 +- ...dows_defender_exclusion_registry_entry.yml | 5 +- ...indows_disable_or_stop_browser_process.yml | 5 +- .../endpoint/windows_event_log_cleared.yml | 5 +- ...fmpeg_audio_and_video_device_discovery.yml | 82 +++++++++++++++++++ ...indows_ffmpeg_directshow_video_capture.yml | 82 +++++++++++++++++++ .../endpoint/windows_firewall_rule_added.yml | 5 +- ..._impair_defense_disable_web_evaluation.yml | 17 +++- ...cated_files_or_information_via_rar_sfx.yml | 5 +- ...ows_process_execution_from_programdata.yml | 5 +- .../windows_process_execution_in_temp_dir.yml | 5 +- stories/salat_stealer.yml | 31 +++++++ 32 files changed, 422 insertions(+), 60 deletions(-) create mode 100644 detections/endpoint/powershell_defender_threat_actions_set_to_allow.yml create mode 100644 detections/endpoint/windows_ffmpeg_audio_and_video_device_discovery.yml create mode 100644 detections/endpoint/windows_ffmpeg_directshow_video_capture.yml create mode 100644 stories/salat_stealer.yml diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index c4c7a588ff..830893e8bf 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -1,8 +1,8 @@ name: Add or Set Windows Defender Exclusion id: 773b66fe-4dd9-11ec-8289-acde48001122 -version: 17 +version: 18 creation_date: '2021-11-25' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -91,6 +91,7 @@ analytic_story: - Windows Defense Evasion Tactics - Crypto Stealer - NetSupport RMM Tool Abuse + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 33eece21e3..45b27e2aa9 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,15 +1,27 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 -version: 18 +version: 19 creation_date: '2021-10-18' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP description: The following analytic detects the modification of Windows Defender registry settings to disable antivirus and antispyware protections. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with Windows Defender policies. This activity is significant because disabling antivirus protections is a common tactic used by adversaries to evade detection and maintain persistence on compromised systems. If confirmed malicious, this action could allow attackers to execute further malicious activities undetected, leading to potential data breaches, system compromise, and further propagation of malware within the network. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_antivirus_registry_filter`' +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + WHERE ( + Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" AND + Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") AND + Registry.registry_value_data IN (1, 0x00000001) + ) + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_antivirus_registry_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable windows defender product references: @@ -42,6 +54,7 @@ analytic_story: - IcedID - Black Basta Ransomware - Cactus Ransomware + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index bfceeca3ee..e3af8d415c 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -1,15 +1,27 @@ name: Disable Defender Submit Samples Consent Feature id: 73922ff8-3022-11ec-bf5e-acde48001122 -version: 15 +version: 16 creation_date: '2021-10-18' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP description: The following analytic detects the modification of the Windows registry to disable the Windows Defender Submit Samples Consent feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path associated with Windows Defender SpyNet and the SubmitSamplesConsent value set to 0x00000000. This activity is significant as it indicates an attempt to bypass or evade detection by preventing Windows Defender from submitting samples for further analysis. If confirmed malicious, this could allow an attacker to execute malicious code without being detected by Windows Defender, leading to potential system compromise. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_submit_samples_consent_feature_filter`' +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + WHERE ( + Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" AND + Registry.registry_value_name = SubmitSamplesConsent AND + Registry.registry_value_data IN (0, 0x00000000) + ) + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_submit_samples_consent_feature_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable windows defender product references: @@ -41,6 +53,7 @@ analytic_story: - IcedID - Windows Registry Abuse - BlankGrabber Stealer + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 66140d6cbe..f01e4f92e9 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -1,15 +1,32 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 -version: 23 +version: 24 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP description: The following analytic identifies modifications in the registry to disable Windows Defender's real-time behavior monitoring. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with Windows Defender settings. This activity is significant because disabling real-time protection is a common tactic used by malware such as RATs, bots, or Trojans to evade detection. If confirmed malicious, this action could allow an attacker to execute code, escalate privileges, or persist in the environment without being detected by antivirus software. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + WHERE ( + Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR + Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR + Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR + Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR + Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR + Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR + Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND + Registry.registry_value_data IN (1, "0x00000001") + ) + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_windows_behavior_monitoring_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable this windows features. references: @@ -44,6 +61,7 @@ analytic_story: - NetSupport RMM Tool Abuse - Storm-0501 Ransomware - BlankGrabber Stealer + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 240c1e95ea..e750dcf81c 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -1,15 +1,24 @@ name: Disable Windows SmartScreen Protection id: 664f0fd0-91ff-11eb-a56f-acde48001122 -version: 16 +version: 17 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP description: The following analytic detects modifications to the Windows registry that disable SmartScreen protection. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with SmartScreen settings. This activity is significant because SmartScreen provides an early warning system against phishing and malware. Disabling it can indicate malicious intent, often seen in Remote Access Trojans (RATs) to evade detection while downloading additional payloads. If confirmed malicious, this action could allow attackers to bypass security measures, increasing the risk of successful phishing attacks and malware infections. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled", "*\\Microsoft\\Windows\\System\\EnableSmartScreen") Registry.registry_value_data IN ("Off", "0") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`' +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + WHERE ( + Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled", "*\\Microsoft\\Windows\\System\\EnableSmartScreen") + Registry.registry_value_data IN ("Off", "0", 0x00000000)) + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_windows_smartscreen_protection_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable this windows features. references: @@ -39,6 +48,7 @@ analytic_story: - Windows Defense Evasion Tactics - CISA AA23-347A - Windows Registry Abuse + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 547444c0ad..b4cd038227 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 24 +version: 25 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -130,6 +130,7 @@ analytic_story: - Void Manticore - Axios Supply Chain Post Compromise - VIP Keylogger + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index 26c9dfd545..b88a680207 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -1,8 +1,8 @@ name: Firewall Allowed Program Enable id: 9a8f63a8-43ac-11ec-904c-acde48001122 -version: 12 +version: 13 creation_date: '2021-11-17' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,6 +51,7 @@ analytic_story: - Windows Defense Evasion Tactics - Medusa Ransomware - Azorult + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1686 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index c1af8acc63..6502ac2a3d 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,8 +1,8 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: 18 +version: 19 creation_date: '2021-09-15' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ analytic_story: - Lokibot - BlankGrabber Stealer - VIP Keylogger + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 163b571ea9..eb994db77b 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,8 +1,8 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: 18 +version: 19 creation_date: '2021-09-15' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,6 +51,7 @@ analytic_story: - Lokibot - BlankGrabber Stealer - VIP Keylogger + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 72d9d32868..657df258aa 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -2,7 +2,7 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 version: 26 creation_date: '2021-08-19' -modification_date: '2026-06-04' +modification_date: '2026-06-08' author: Michael Haag, Splunk status: production type: Hunting @@ -84,6 +84,7 @@ analytic_story: - Microsoft WSUS CVE-2025-59287 - MuddyWater - Axios Supply Chain Post Compromise + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/powershell_defender_threat_actions_set_to_allow.yml b/detections/endpoint/powershell_defender_threat_actions_set_to_allow.yml new file mode 100644 index 0000000000..559f874a71 --- /dev/null +++ b/detections/endpoint/powershell_defender_threat_actions_set_to_allow.yml @@ -0,0 +1,79 @@ +name: Powershell Defender Threat Actions Set to Allow +id: 7dd3ced1-dc48-4998-9bc2-57e6ae5efaa7 +version: 1 +creation_date: '2026-05-12' +modification_date: '2026-05-12' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the setting of the Windows Defender Threat Actions to allow. It leverages data from the Endpoint.Processes data model, specifically monitoring the execution of the `Set-MpPreference` cmdlet with the `-HighThreatDefaultAction`, `-ModerateThreatDefaultAction`, `-LowThreatDefaultAction`, and `-SevereThreatDefaultAction` parameters set to `6`. This activity is significant because it is commonly used by malware such as RATs, bots, or Trojans to evade detection by allowing threats to pass through the Windows Defender antivirus engine. If confirmed malicious, this action could allow an attacker to execute malicious code without being detected by Windows Defender, leading to potential data exfiltration, further system compromise, or persistent access within the environment. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: | + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Processes where + `process_powershell` + Processes.process="*Set-MpPreference*" + ( + Processes.process IN ( + "*-HighThreatDefaultAction*", + "*-ModerateThreatDefaultAction*", + "*-LowThreatDefaultAction*", + "*-SevereThreatDefaultAction*" + ) + Processes.process IN ( + "* 6*" + ) + ) + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_defender_threat_actions_set_to_allow_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Limited false positives. However, tune based on scripts that may perform this action. +references: + - https://www.broadcom.com/support/security-center/protection-bulletin/uac-0252-activity-delivering-shadowsniff-and-salatstealer-malware + - https://bazaar.abuse.ch/browse/tag/SalatStealer/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Process Commandline [$process$] that Set to Allow Windows Defender Threat Actions on [$dest$]. + entity: + field: dest + type: system + score: 50 +analytic_story: + - Salat Stealer +asset_type: Endpoint +mitre_attack_id: + - T1059.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/threat_allow_switch/threat_allow_salat.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 7d9770d935..2c50536886 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -1,8 +1,8 @@ name: Powershell Disable Security Monitoring id: c148a894-dd93-11eb-bf2a-acde48001122 -version: 16 +version: 17 creation_date: '2021-07-05' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -112,6 +112,7 @@ analytic_story: - Revil Ransomware - CISA AA24-241A - BlankGrabber Stealer + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index c82be2b33b..5ce2244b6c 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -1,8 +1,8 @@ name: Powershell Fileless Script Contains Base64 Encoded Content id: 8acbc04c-c882-11eb-b060-acde48001122 -version: 20 +version: 21 creation_date: '2021-06-09' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Michael Haag, Splunk status: production type: TTP @@ -52,6 +52,7 @@ analytic_story: - MuddyWater - Axios Supply Chain Post Compromise - VIP Keylogger + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1027 diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 5bd40d097e..9a50398177 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -1,8 +1,8 @@ name: Powershell Processing Stream Of Data id: 0d718b52-c9f1-11eb-bc61-acde48001122 -version: 17 +version: 18 creation_date: '2021-06-14' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: TTP @@ -65,6 +65,7 @@ analytic_story: - XWorm - MoonPeak - MuddyWater + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index 9d3ba1f546..92e8a6216a 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -1,8 +1,8 @@ name: Powershell Using memory As Backing Store id: c396a0c4-c9f2-11eb-b4f5-acde48001122 -version: 13 +version: 14 creation_date: '2021-06-14' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: TTP @@ -58,6 +58,7 @@ analytic_story: - Hermetic Wiper - IcedID - Malicious PowerShell + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 5697122b9e..fb2ad11876 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -1,8 +1,8 @@ name: Powershell Windows Defender Exclusion Commands id: 907ac95c-4dd9-11ec-ba2c-acde48001122 -version: 15 +version: 16 creation_date: '2021-11-25' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: TTP @@ -58,6 +58,7 @@ analytic_story: - Warzone RAT - NetSupport RMM Tool Abuse - BlankGrabber Stealer + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 1b6f308c50..4a8943311b 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,8 +1,8 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 32 +version: 33 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -81,6 +81,7 @@ analytic_story: - MuddyWater - Gh0st RAT - Axios Supply Chain Post Compromise + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index 9372103751..d3b92a9ed6 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -1,8 +1,8 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 -version: 22 +version: 23 creation_date: '2022-09-05' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,6 +52,7 @@ analytic_story: - Scattered Lapsus$ Hunters - Tuoni - Gh0st RAT + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1134.002 diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index 70709c1318..b1cd70305e 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -1,8 +1,8 @@ name: Windows Credential Access From Browser Password Store id: 72013a8e-5cea-408a-9d51-5585386b4d69 -version: 21 +version: 22 creation_date: '2024-03-20' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Bhavin Patel Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ analytic_story: - Scattered Lapsus$ Hunters - BlankGrabber Stealer - VIP Keylogger + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 476ffbb665..b0b967890f 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: 21 +version: 22 creation_date: '2023-05-02' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,6 +53,7 @@ analytic_story: - Scattered Lapsus$ Hunters - BlankGrabber Stealer - VIP Keylogger + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index e926f75712..45f9303784 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: 21 +version: 22 creation_date: '2023-05-02' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,6 +53,7 @@ analytic_story: - Scattered Lapsus$ Hunters - BlankGrabber Stealer - VIP Keylogger + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 165c3a388a..1896fa962c 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -1,8 +1,8 @@ name: Windows Defender Exclusion Registry Entry id: 13395a44-4dd9-11ec-9df7-acde48001122 -version: 17 +version: 18 creation_date: '2021-11-25' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -46,6 +46,7 @@ analytic_story: - Warzone RAT - Windows Defense Evasion Tactics - NetSupport RMM Tool Abuse + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index 4d4acf568c..e0fc266cb0 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -1,8 +1,8 @@ name: Windows Disable or Stop Browser Process id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5 -version: 12 +version: 13 creation_date: '2024-10-18' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: TTP @@ -55,6 +55,7 @@ analytic_story: - Hellcat Ransomware - Castle RAT - BlankGrabber Stealer + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index e443bdc6ad..62f1270f73 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -1,8 +1,8 @@ name: Windows Event Log Cleared id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a -version: 20 +version: 21 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -48,6 +48,7 @@ analytic_story: - CISA AA22-264A - Compromised Windows Host - Clop Ransomware + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685.005 diff --git a/detections/endpoint/windows_ffmpeg_audio_and_video_device_discovery.yml b/detections/endpoint/windows_ffmpeg_audio_and_video_device_discovery.yml new file mode 100644 index 0000000000..61c5c27e24 --- /dev/null +++ b/detections/endpoint/windows_ffmpeg_audio_and_video_device_discovery.yml @@ -0,0 +1,82 @@ +name: Windows FFmpeg Audio and Video Device Discovery +id: 6394c389-3863-4677-bcbd-07d1519b34d2 +version: 1 +creation_date: '2026-05-20' +modification_date: '2026-05-20' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: This analytic detects the use of FFmpeg (ffmpeg.exe) to enumerate connected audio and video devices on a Windows endpoint. Adversaries and stealers such as SalatStealer abuse FFmpeg's DirectShow (dshow) input interface by invoking it with the -list_devices true and -hide_banner flags from a temporary directory, allowing them to silently discover available webcams, microphones, and capture cards without triggering obvious user-facing activity. Device discovery of this kind maps to MITRE ATT&CK T1125 (Video Capture), where threat actors profile the system's multimedia capabilities as a precursor to covert audio or video surveillance. The combination of an unusual process path (temp), the dshow input filter, and the device-listing arguments is a strong indicator of malicious reconnaissance rather than legitimate administrative use. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes + WHERE ( + ( + Processes.process_name = ffmpeg.exe OR + Processes.original_file_name = ffmpeg.exe + ) AND + + Processes.process_path IN ("*\\temp\\*") AND + Processes.process = "*-list_devices*" AND + Processes.process = "*-hide_banner*" AND + Processes.process = "* dshow *" + ) + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ffmpeg_audio_and_video_device_discovery_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +references: + - https://www.broadcom.com/support/security-center/protection-bulletin/uac-0252-activity-delivering-shadowsniff-and-salatstealer-malware + - https://bazaar.abuse.ch/browse/tag/SalatStealer/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: a ffmpeg.exe process [$process_path$] list video and audio devices on [$dest$]. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Salat Stealer +asset_type: Endpoint +mitre_attack_id: + - T1125 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1125/salat_stealer_ffmpeg/ffmpeg_event.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_ffmpeg_directshow_video_capture.yml b/detections/endpoint/windows_ffmpeg_directshow_video_capture.yml new file mode 100644 index 0000000000..d27cb6bf8a --- /dev/null +++ b/detections/endpoint/windows_ffmpeg_directshow_video_capture.yml @@ -0,0 +1,82 @@ +name: Windows FFmpeg DirectShow Video Capture +id: 636f1a0b-562a-4629-80f6-5ad46d2ebdee +version: 1 +creation_date: '2026-05-20' +modification_date: '2026-05-20' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: This analytic detects active video capture performed by FFmpeg (ffmpeg.exe) via the Windows DirectShow (dshow) interface, a technique observed in SalatStealer and related UAC-0252 campaigns. After enumerating available devices, threat actors invoke FFmpeg with a specific video capture command that references a named webcam device (video=), requests MJPEG encoding (mjpeg), and uses the dshow input filter — all from a temporary directory to reduce forensic footprint. This sequence moves beyond reconnaissance into active collection, aligning with MITRE ATT&CK T1125 (Video Capture), where adversaries silently record from the victim's webcam to gather intelligence or capture sensitive on-screen activity. The presence of ffmpeg.exe in a temp path combined with these DirectShow video arguments is highly anomalous outside of dedicated multimedia or screen-recording software, making it a strong signal of covert surveillance activity. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes + WHERE ( + ( + Processes.process_name = ffmpeg.exe OR + Processes.original_file_name = ffmpeg.exe + ) AND + + Processes.process_path IN ("*\\temp\\*") AND + Processes.process = "*video=*" AND + Processes.process = "* mjpeg *" AND + Processes.process = "* dshow *" + ) + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ffmpeg_directshow_video_capture_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +references: + - https://www.broadcom.com/support/security-center/protection-bulletin/uac-0252-activity-delivering-shadowsniff-and-salatstealer-malware + - https://bazaar.abuse.ch/browse/tag/SalatStealer/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: a ffmpeg.exe process [$process_path$] capture video using DirectShow on [$dest$]. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Salat Stealer +asset_type: Endpoint +mitre_attack_id: + - T1125 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1125/salat_stealer_ffmpeg/ffmpeg_event.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_firewall_rule_added.yml b/detections/endpoint/windows_firewall_rule_added.yml index c423897af7..30113438a7 100644 --- a/detections/endpoint/windows_firewall_rule_added.yml +++ b/detections/endpoint/windows_firewall_rule_added.yml @@ -1,8 +1,8 @@ name: Windows Firewall Rule Added id: efc25501-4e75-4075-8cc5-ac80f2847d80 -version: 8 +version: 9 creation_date: '2025-03-21' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -40,6 +40,7 @@ analytic_story: - ShrinkLocker - Medusa Ransomware - NetSupport RMM Tool Abuse + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1686 diff --git a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml index 74be707372..2401d08520 100644 --- a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml +++ b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml @@ -1,15 +1,25 @@ name: Windows Impair Defense Disable Web Evaluation id: e234970c-dcf5-4f80-b6a9-3a562544ca5b -version: 12 +version: 13 creation_date: '2024-01-29' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects modifications to the Windows registry entry "EnableWebContentEvaluation" to disable Windows Defender web content evaluation. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes where the registry value is set to "0x00000000". This activity is significant as it indicates an attempt to impair browser security features, potentially allowing malicious web content to bypass security checks. If confirmed malicious, this could lead to users interacting with harmful scripts or unsafe web elements, increasing the risk of system exploitation and security breaches. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation" Registry.registry_value_data= "0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_web_evaluation_filter`' +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + WHERE ( + Registry.registry_path= "*\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation" AND + Registry.registry_value_data IN (0, "0x00000000") + ) + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_web_evaluation_filter` how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. references: @@ -33,6 +43,7 @@ finding: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml index 29fafef715..52a4fea38c 100644 --- a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml +++ b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml @@ -1,8 +1,8 @@ name: Windows Obfuscated Files or Information via RAR SFX id: 4ab6862b-ce88-4223-96c0-f6da2cffb898 -version: 9 +version: 10 creation_date: '2021-08-03' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -44,6 +44,7 @@ analytic_story: - Crypto Stealer - APT37 Rustonotto and FadeStealer - GhostRedirector IIS Module and Rungan Backdoor + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1027.013 diff --git a/detections/endpoint/windows_process_execution_from_programdata.yml b/detections/endpoint/windows_process_execution_from_programdata.yml index ea33c7f98a..b854063e07 100644 --- a/detections/endpoint/windows_process_execution_from_programdata.yml +++ b/detections/endpoint/windows_process_execution_from_programdata.yml @@ -1,8 +1,8 @@ name: Windows Process Execution From ProgramData id: 237016fa-d8e6-47b4-80f9-70c4d42c72c0 -version: 9 +version: 10 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -50,6 +50,7 @@ analytic_story: - APT37 Rustonotto and FadeStealer - GhostRedirector IIS Module and Rungan Backdoor - Axios Supply Chain Post Compromise + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1036.005 diff --git a/detections/endpoint/windows_process_execution_in_temp_dir.yml b/detections/endpoint/windows_process_execution_in_temp_dir.yml index 80eee0c513..5957c2c2d8 100644 --- a/detections/endpoint/windows_process_execution_in_temp_dir.yml +++ b/detections/endpoint/windows_process_execution_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Process Execution in Temp Dir id: f6fbe929-4187-4ba4-901e-8a34be838443 -version: 11 +version: 12 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-06-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,6 +53,7 @@ analytic_story: - SesameOp - Gh0st RAT - Axios Supply Chain Post Compromise + - Salat Stealer asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/stories/salat_stealer.yml b/stories/salat_stealer.yml new file mode 100644 index 0000000000..da40a9d032 --- /dev/null +++ b/stories/salat_stealer.yml @@ -0,0 +1,31 @@ +name: Salat Stealer +id: d4f2a1b3-5c6e-4d7f-8e9a-1b2c3d4e5f60 +version: 1 +creation_date: '2026-05-12' +modification_date: '2026-05-12' +author: Teoderick Contreras, Splunk +status: production +description: | + Salat Stealer is a Windows-based information-stealing malware associated with the UAC-0252 threat activity group, which has been observed delivering it alongside the ShadowSniff credential harvester. + Once deployed, Salat Stealer targets sensitive data stored on the victim endpoint, including browser-saved passwords, cookies, autofill entries, and session tokens from popular Chromium and Gecko-based browsers. + To ensure persistence and avoid interruption, the malware actively tampers with Windows Defender by modifying threat-action policies through PowerShell Set-MpPreference commands, allowing malicious files and processes to bypass antivirus enforcement. + Salat Stealer typically arrives via phishing campaigns or trojanized software packages, then operates stealthily within user-context directories to minimize its footprint. + Collected data is packaged and exfiltrated to attacker-controlled command-and-control infrastructure, often over encrypted channels. + Detection requires monitoring for unauthorized Windows Defender configuration changes, suspicious PowerShell execution, abnormal access to browser credential stores, and outbound connections to known Salat Stealer C2 endpoints. +narrative: | + Salat Stealer surfaces as part of the UAC-0252 campaign, a threat cluster observed distributing multiple credential-harvesting tools targeting organizations primarily in Ukraine and surrounding regions. + The infection chain typically begins with a phishing email carrying a malicious attachment or a link to a trojanized installer, luring victims into executing the payload under the guise of a legitimate file. + Once running, Salat Stealer immediately moves to disable or weaken Windows Defender by issuing PowerShell Set-MpPreference commands that set high-, moderate-, low-, and severe-threat default actions to allow, effectively granting all detected threats a free pass. + With defenses lowered, the malware enumerates the system and harvests browser-stored credentials, cookies, and session data from Chromium-based and Firefox-derived browsers. + The stolen information is compressed and transmitted to remote command-and-control servers, where operators can monetize it through credential sales, account takeover, or use it to facilitate deeper intrusion into corporate networks. + Security teams investigating Salat Stealer activity should correlate PowerShell-based Defender tampering events with unusual process access to browser SQLite databases and anomalous outbound HTTPS traffic, as these together form a reliable behavioral fingerprint for the malware. +references: + - https://www.broadcom.com/support/security-center/protection-bulletin/uac-0252-activity-delivering-shadowsniff-and-salatstealer-malware + - https://bazaar.abuse.ch/browse/tag/SalatStealer/ +category: + - Malware +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection \ No newline at end of file From f443d99533e70a0a04b614d729448501252c6b5f Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Tue, 16 Jun 2026 10:46:31 +0200 Subject: [PATCH 009/164] detection_fixes_2 (#4107) * Deprecate regsvr32 silent switch detection and improve replacement logic. Move the redundant silent-switch detection to removed/detections per escu_6 conventions and tighten the remaining regsvr32 silent/install detection search. Co-authored-by: Cursor * fix --------- Co-authored-by: Teoderick Contreras Co-authored-by: Cursor Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: Bhavin Patel --- ...svr32_with_known_silent_switch_cmdline.yml | 11 ++++-- ...2_silent_and_install_param_dll_loading.yml | 34 +++++++++++-------- 2 files changed, 27 insertions(+), 18 deletions(-) rename detections/{endpoint => deprecated}/regsvr32_with_known_silent_switch_cmdline.yml (94%) diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml similarity index 94% rename from detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml rename to detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml index 6e093f9729..b9f41a3708 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml @@ -1,10 +1,15 @@ name: Regsvr32 with Known Silent Switch Cmdline id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 -version: 14 +version: 15 creation_date: '2021-07-29' -modification_date: '2026-05-13' +modification_date: '2026-06-09' author: Teoderick Contreras, Splunk -status: production +status: deprecated +deprecation_info: + reason: Detection has been deprecated since its logic is already covered by another more improved detection. + removed_in_version: 6.4.0 + replacement_content: + - Regsvr32 Silent and Install Param Dll Loading type: Anomaly description: The following analytic detects the execution of Regsvr32.exe with the silent switch to load DLLs. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions containing the `-s` or `/s` switches. This activity is significant as it is commonly used in malware campaigns, such as IcedID, to stealthily load malicious DLLs. If confirmed malicious, this could allow an attacker to execute arbitrary code, download additional payloads, and potentially compromise the system further. Immediate investigation and endpoint isolation are recommended. data_source: diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 2fe2b55d19..46996d8c89 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -1,8 +1,8 @@ name: Regsvr32 Silent and Install Param Dll Loading id: f421c250-24e7-11ec-bc43-acde48001122 -version: 14 +version: 15 creation_date: '2021-10-04' -modification_date: '2026-05-13' +modification_date: '2026-06-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,22 +12,26 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE `process_regsvr32` - AND - Processes.process="*/i*" AND NOT Processes.process="*Microsoft\\TeamsMeetingAddin*" - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + `process_regsvr32` + Processes.process IN ("*/i*", "*-i*") + Processes.process IN ("*/s*", "*-s*") + NOT Processes.process="*Microsoft\\TeamsMeetingAddin*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | where match(process,"(?i)[\- - | \/][Ss]{1}") | `regsvr32_silent_and_install_param_dll_loading_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: | From 46e3f8509d3e9b434130524c49aabf3a35bd6cfc Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Tue, 16 Jun 2026 11:20:27 +0200 Subject: [PATCH 010/164] rogue_planet (#4121) * rogue_planet * rogue_planet * rogue_planet * update indent --------- Co-authored-by: Teoderick Contreras Co-authored-by: Nasreddine Bencherchali Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: Bhavin Patel --- ...tables_or_script_creation_in_temp_path.yml | 3 +- .../windows_process_execution_in_temp_dir.yml | 1 + .../windows_suspicious_process_file_path.yml | 5 +- ...rmgr_alternate_data_stream_in_temp_dir.yml | 68 +++++++++++++++++++ stories/rogueplanet.yml | 33 +++++++++ 5 files changed, 107 insertions(+), 3 deletions(-) create mode 100644 detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml create mode 100644 stories/rogueplanet.yml diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index b4cd038227..598c7fa87e 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -2,7 +2,7 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 version: 25 creation_date: '2021-05-07' -modification_date: '2026-06-08' +modification_date: '2026-06-11' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -130,6 +130,7 @@ analytic_story: - Void Manticore - Axios Supply Chain Post Compromise - VIP Keylogger + - RoguePlanet - Salat Stealer asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_process_execution_in_temp_dir.yml b/detections/endpoint/windows_process_execution_in_temp_dir.yml index 5957c2c2d8..0f799e87ec 100644 --- a/detections/endpoint/windows_process_execution_in_temp_dir.yml +++ b/detections/endpoint/windows_process_execution_in_temp_dir.yml @@ -53,6 +53,7 @@ analytic_story: - SesameOp - Gh0st RAT - Axios Supply Chain Post Compromise + - RoguePlanet - Salat Stealer asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 7a30539612..410963926e 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 24 +version: 25 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-06-11' author: Teoderick Contreras, Splunk status: production type: TTP @@ -94,6 +94,7 @@ analytic_story: - Void Manticore - Axios Supply Chain Post Compromise - VIP Keylogger + - RoguePlanet asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml new file mode 100644 index 0000000000..b3ff2e6f63 --- /dev/null +++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml @@ -0,0 +1,68 @@ +name: Windows Wermgr Alternate Data Stream in Temp Dir +id: 65222e9b-9d0b-4bfe-8da1-199b98e1d44a +version: 1 +creation_date: '2026-06-11' +modification_date: '2026-06-11' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the wermgr.exe process creating an alternate stream in the temp directory. It leverages Sysmon EventID 15 to identify these actions. + This activity is significant because wermgr.exe is typically associated with error reporting, not file creation. Such activity is significant as it may indicate RoguePlanet malware, which creates an alternate stream in the temp directory to execute malicious code. + If confirmed malicious, this could lead to further malware infections, data exfiltration, or system compromise. +data_source: + - Sysmon EventID 15 +search: |- + `sysmon` + EventCode=15 + TargetFilename = "*\\Temp\\*" + TargetFilename = "*\\wermgr.exe:*" + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest dvc file_hash file_name file_path process_exec + process_guid process_id process_name process_path + signature signature_id user_id vendor_product Contents Image + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_wermgr_alternate_data_stream_in_temp_dir_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +known_false_positives: |- + No false positives have been identified at this time. +references: + - https://github.com/MSNightmare/RoguePlanet/tree/main +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A [$process_name$] created a wermgr.exe alternate stream in the temp directory on $dest$ by $user$ +analytic_story: + - RoguePlanet +asset_type: Endpoint +mitre_attack_id: + - T1564.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.004/rogueplanet/rogue_15.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/stories/rogueplanet.yml b/stories/rogueplanet.yml new file mode 100644 index 0000000000..5ad81b0574 --- /dev/null +++ b/stories/rogueplanet.yml @@ -0,0 +1,33 @@ +name: RoguePlanet +id: eafb5ab2-71bb-4da9-a541-015d002f01f1 +version: 1 +creation_date: '2026-06-11' +modification_date: '2026-06-11' +author: Teoderick Contreras, Splunk +status: production +description: |- + RoguePlanet is a publicly released proof-of-concept exploit targeting a race condition in Microsoft Windows Defender. The attack abuses Defender scanning behavior, NTFS alternate data streams, virtual ISO mounting, volume shadow copy paths, and opportunistic oplocks to achieve local privilege escalation to SYSTEM. + Successful exploitation spawns a privileged shell. The PoC has been tested on Windows 10 and Windows 11 client builds with current patches as of mid-2026; standard users cannot mount ISO images on Windows Server, though the underlying vulnerability is believed to affect server platforms as well. +narrative: | + RoguePlanet, published by MSNightmare, is a Windows Defender local privilege escalation exploit built around a race condition. Unlike traditional service abuse or token manipulation chains, this attack weaponizes Defender's own scanning pipeline. The exploit is probabilistic — success rates vary by host — but when it lands, the attacker obtains a SYSTEM-level shell. + + The attack begins when a low-privileged user executes RoguePlanet.exe, typically from a user-writable location such as a public tools directory or downloads folder. The binary creates a working directory under %TEMP% using the RP_ prefix, mounts an embedded ISO image through the Windows Virtual Disk API, and stages a malicious payload disguised as wermgr.exe. A distinctive hallmark of the exploit is creation of an NTFS alternate data stream named :WDFOO on that file. The PoC also writes EICAR-like content to trigger an on-access scan by MsMpEng.exe. + + To win the race, RoguePlanet uses opportunistic oplocks, directory junctions, and volume shadow copy paths. It opens handles against shadow-copy-resolved paths such as ...\wermgr.exe:WDFOO, requests oplocks, and coordinates file supersede and rename operations while Defender is actively scanning the staged content. A named pipe at \\.\pipe\RoguePlanet is used to synchronize the final SYSTEM-context stage. When the race succeeds, the elevated instance launches an interactive console in the originating user session. + + From a detection standpoint, the most durable observables are Sysmon Event ID 15 records showing :WDFOO alternate data streams on wermgr.exe under RP_* temp directories, MsMpEng.exe touching those same paths, and the initial RoguePlanet.exe process writing ADS content. Secondary signals include creation of RP_* directories, virtual disk attach activity, reparse-point manipulation, and a user-context process later spawning SYSTEM-integrity children. + + This analytic story groups detections that surface alternate data stream abuse, suspicious Defender-adjacent file activity, and privilege escalation patterns consistent with RoguePlanet and similar Windows Defender bypass research. Security teams should treat any matching activity as high priority, validate patch and Defender configuration status, and isolate affected endpoints pending vendor guidance. +references: + - https://github.com/MSNightmare/RoguePlanet/tree/main + - https://attack.mitre.org/techniques/T1068/ + - https://attack.mitre.org/techniques/T1564/004/ + - https://attack.mitre.org/techniques/T1211/ + - https://car.mitre.org/analytics/CAR-2020-08-001/ +category: + - Adversary Tactics +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection From 4155c6cf1706a8fd3a233659fb839facc63f1568 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 17 Jun 2026 01:04:01 +0530 Subject: [PATCH 011/164] udpating risk_message (#4129) --- .../endpoint/windows_suspicious_burst_of_password_changes.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml index 84fc995ac6..b0d3a2986e 100644 --- a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml +++ b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml @@ -62,7 +62,7 @@ drilldown_searches: name: View risk events for the last 7 days for - "$user$" and "$dest$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' finding: - title: Rapid burst of password changes of local accounts by $SubjectUserName$ on $dest$ + title: Rapid burst of password changes of local accounts by $InitiatingAccounts$ on $dest$ entity: field: dest type: system From bf5654a61d025552cc09909c21a1fc8ddc28bccf Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 17 Jun 2026 12:34:17 -0700 Subject: [PATCH 012/164] TAs were pointing to versions that have been (#4130) pulled from splunkbase --- contentctl.yml | 4 ++-- data_sources/azure_active_directory.yml | 2 +- ...directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- .../azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_microsoftgraphactivitylogs.yml | 2 +- .../azure_active_directory_noninteractiveusersigninlogs.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...ure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...ure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...ure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- data_sources/palo_alto_network_threat.yml | 2 +- data_sources/palo_alto_network_traffic.yml | 2 +- 26 files changed, 27 insertions(+), 27 deletions(-) diff --git a/contentctl.yml b/contentctl.yml index 5db591c8f4..8152146905 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -131,7 +131,7 @@ apps: - uid: 2757 title: Splunk Add-on for Palo Alto Networks appid: SPLUNK_ADD_ON_FOR_PALO_ALTO_NETWORKS - version: 3.0.1 + version: 3.1.0 description: description of app hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-palo-alto-networks_301.tgz - uid: 3865 @@ -167,7 +167,7 @@ apps: - uid: 3110 title: Splunk Add-on for Microsoft Cloud Services appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES - version: 6.1.1 + version: 6.1.3 description: description of app hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_611.tgz - uid: 4055 diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index f6a672edab..4b353862ea 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index d66b843837..182d512dca 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 55c848f562..5031b5cd33 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 765ccc7401..f0c01197f6 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index 6c7686c2f5..c5e2c3a4e5 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index b9880438f1..7b4411afbd 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 8a43552df9..1461a8eaa6 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index eb4211d946..177b30e212 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 691fee9316..b7fd87116e 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 7d6c1a831e..22983a3d9f 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index c7afc48de5..65cb093d4f 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index ff1573b80e..8c5adbf8ae 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 3da7f3b6f2..da60f90a28 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 2feea34e28..9a0c666f20 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 49445e5bc3..d6888c0dee 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 6ac5a8e419..b0ae6b37c9 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 000e4feec5..7a086791e4 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index e8b3fb5929..f0ca04a229 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index cae5dfe6ab..ce39762a76 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 1456c5f3da..fb083554f3 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 1c0d9a0864..1c61b96dac 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index b83dcf595a..c1d309bda9 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index d0fb8d2f59..5b89633bdb 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - column - action diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index 1e07c2689a..b83bd67d0b 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.0.1 + version: 3.1.0 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index de8b46c579..00e9798ece 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.0.1 + version: 3.1.0 fields: - _time - date_hour From 395e1db799692e78c002c09e0a6398ca86d1ae49 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 22 Jun 2026 16:20:32 +0530 Subject: [PATCH 013/164] chore: bump contentctl.yml and build.yml to 6.2.0 (#4131) Co-authored-by: research bot --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index 57d97a4949..cca64df09e 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.1.0 +app_version: 6.2.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index 8152146905..abb5d9c6ab 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.1.0 + version: 6.2.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 3afca81b06746996d8485a0f6ae6e093e0e15043 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 24 Jun 2026 17:12:53 +0530 Subject: [PATCH 014/164] Splunk Vuln content to Github (#4134) * move from gitlab * moving removed from gitlab * udpating versions due to removal of whitespace * UTC is 23 * deprecate content * bump ver --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- .gitignore | 1 + ...entication_token_exposure_in_debug_log.yml | 70 ++++++++++++++++ ...rary_file_write_to_windows_system_root.yml | 80 +++++++++++++++++++ .../application/splunk_rce_via_user_xslt.yml | 36 +++++++++ ...n_disclosure_in_debug_logging_channels.yml | 60 ++++++++++++++ .../splunk_user_enumeration_attempt.yml | 55 +++++++++++++ ...scalation_via_custom_urls_in_dashboard.yml | 41 ++++++++++ ..._lookup_file_editing_rce_via_user_xslt.yml | 32 ++++++++ ...on_via_custom_dashboard_leading_to_rce.yml | 40 ++++++++++ ...prise_kv_store_incorrect_authorization.yml | 41 ++++++++++ ...nformation_disclosure_on_account_login.yml | 41 ++++++++++ ...sal_in_splunk_app_for_lookup_file_edit.yml | 39 +++++++++ .../deprecated/splunk_rce_pdfgen_render.yml | 56 +++++++++++++ lookups/csv/splunk_risky_command.csv | 16 ++++ lookups/csv/splunk_risky_command.yml | 13 +++ macros/audittrail.yml | 8 ++ macros/deprecated/audit_searches.yml | 8 ++ macros/deprecated/bro_ssl_json.yml | 8 ++ .../path_traversal_spl_injection.yml | 8 ++ macros/deprecated/splunk_crash_log.yml | 8 ++ macros/deprecated/splunk_python.yml | 8 ++ .../splunkd_investigation_rest_handler.yml | 8 ++ macros/deprecated/splunkd_web.yml | 8 ++ macros/deprecated/splunkd_webs.yml | 8 ++ macros/deprecated/splunkd_webx.yml | 8 ++ macros/splunkd.yml | 8 ++ macros/splunkd_failed_auths.yml | 8 ++ macros/splunkd_ui.yml | 8 ++ macros/splunkda.yml | 8 ++ ...ng_interpreter_risky_spl_mltk_baseline.yml | 34 ++++++++ ...ct_risky_spl_using_pretrained_ml_model.yml | 46 +++++++++++ .../open_redirect_in_splunk_web.yml | 36 +++++++++ .../path_traversal_spl_injection.yml | 57 +++++++++++++ ...rapiddiag_through_user_interface_views.yml | 56 +++++++++++++ ...te_path_traversal_using_runshellscript.yml | 54 +++++++++++++ ...scovery_drilldown_dashboard_disclosure.yml | 39 +++++++++ ...and_scripting_interpreter_delete_usage.yml | 56 +++++++++++++ ...d_scripting_interpreter_risky_commands.yml | 43 ++++++++++ ...d_scripting_interpreter_risky_spl_mltk.yml | 57 +++++++++++++ ...srf_in_the_ssg_kvstore_client_endpoint.yml | 56 +++++++++++++ ...om_analytics_workspace_using_sid_query.yml | 40 ++++++++++ ...al_certificates_infrastructure_version.yml | 42 ++++++++++ ...igital_certificates_lack_of_encryption.yml | 58 ++++++++++++++ ...ore_via_csrf_enabling_maintenance_mode.yml | 56 +++++++++++++ ...plunk_dos_using_malformed_saml_request.yml | 38 +++++++++ .../splunk_dos_via_dump_spl_command.yml | 37 +++++++++ .../splunk_dos_via_malformed_s2s_request.yml | 58 ++++++++++++++ ...os_via_post_request_datamodel_endpoint.yml | 40 ++++++++++ .../splunk_dos_via_printf_search_function.yml | 40 ++++++++++ .../splunk_edit_user_privilege_escalation.yml | 40 ++++++++++ ...ndpoint_denial_of_service_dos_zip_bomb.yml | 57 +++++++++++++ ...lunk_enterprise_information_disclosure.yml | 36 +++++++++ ...windows_deserialization_file_partition.yml | 54 +++++++++++++ ...ons_manager_via_investigation_creation.yml | 57 +++++++++++++ ..._dos_through_investigation_attachments.yml | 54 +++++++++++++ ...esponse_splitting_via_rest_spl_command.yml | 36 +++++++++ ...splunk_identified_ssl_tls_certificates.yml | 41 ++++++++++ ...re_via_pdf_export_in_classic_dashboard.yml | 46 +++++++++++ ...ly_formatted_parameter_crashes_splunkd.yml | 50 ++++++++++++ ...on_disclosure_in_splunk_add_on_builder.yml | 30 +++++++ ...nk_list_all_nonstandard_admin_accounts.yml | 33 ++++++++ ...obody_splunkdeploymentserverconfig_app.yml | 37 +++++++++ ...e_user_can_view_hashed_splunk_password.yml | 36 +++++++++ .../splunk_persistent_xss_via_props_conf.yml | 45 +++++++++++ ...unk_persistent_xss_via_scheduled_views.yml | 45 +++++++++++ ..._via_url_validation_bypass_w_dashboard.yml | 38 +++++++++ ...s_injection_forwarder_bundle_downloads.yml | 41 ++++++++++ ...sonation_weak_encryption_configuration.yml | 42 ++++++++++ ...personation_weak_encryption_selfsigned.yml | 42 ++++++++++ ...sonation_weak_encryption_simplerequest.yml | 42 ++++++++++ ...pass_on_indexing_preview_rest_endpoint.yml | 36 +++++++++ ...nk_rce_via_external_lookup_copybuckets.yml | 36 +++++++++ ...unk_rce_via_serialized_session_payload.yml | 40 ++++++++++ ..._gateway__splunk_mobile_alerts_feature.yml | 40 ++++++++++ ...ected_xss_in_the_templates_lists_radio.yml | 40 ++++++++++ ...ected_xss_on_app_search_table_endpoint.yml | 38 +++++++++ ..._command_abuse_disclosed_february_2023.yml | 69 ++++++++++++++++ ...ormation_disclosure_for_low_privs_user.yml | 43 ++++++++++ ...ored_xss_conf_web_settings_on_premises.yml | 39 +++++++++ ...ed_xss_via_data_model_objectname_field.yml | 41 ++++++++++ ...via_specially_crafted_bulletin_message.yml | 39 +++++++++ ...icated_dos_via_null_pointer_references.yml | 38 +++++++++ ...nticated_log_injection_web_service_log.yml | 40 ++++++++++ ...cated_path_traversal_modules_messaging.yml | 37 +++++++++ ...authorized_experimental_items_creation.yml | 38 +++++++++ ...nauthorized_notification_input_by_user.yml | 39 +++++++++ ...nsions_allowed_by_lookup_table_uploads.yml | 56 +++++++++++++ .../splunk_xss_in_highlighted_json_events.yml | 40 ++++++++++ .../splunk_xss_in_monitoring_console.yml | 45 +++++++++++ ...ave_table_dialog_header_in_search_page.yml | 41 ++++++++++ ...s_via_external_urls_in_dashboards_ssrf.yml | 38 +++++++++ removed/detections/splunk_xss_via_view.yml | 40 ++++++++++ stories/splunk_vulnerabilities.yml | 18 +++++ 93 files changed, 3509 insertions(+) create mode 100644 detections/application/splunk_authentication_token_exposure_in_debug_log.yml create mode 100644 detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml create mode 100644 detections/application/splunk_rce_via_user_xslt.yml create mode 100644 detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml create mode 100644 detections/application/splunk_user_enumeration_attempt.yml create mode 100644 detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml create mode 100644 detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml create mode 100644 detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml create mode 100644 detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml create mode 100644 detections/deprecated/splunk_information_disclosure_on_account_login.yml create mode 100644 detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml create mode 100644 detections/deprecated/splunk_rce_pdfgen_render.yml create mode 100644 lookups/csv/splunk_risky_command.csv create mode 100644 lookups/csv/splunk_risky_command.yml create mode 100644 macros/audittrail.yml create mode 100644 macros/deprecated/audit_searches.yml create mode 100644 macros/deprecated/bro_ssl_json.yml create mode 100644 macros/deprecated/path_traversal_spl_injection.yml create mode 100644 macros/deprecated/splunk_crash_log.yml create mode 100644 macros/deprecated/splunk_python.yml create mode 100644 macros/deprecated/splunkd_investigation_rest_handler.yml create mode 100644 macros/deprecated/splunkd_web.yml create mode 100644 macros/deprecated/splunkd_webs.yml create mode 100644 macros/deprecated/splunkd_webx.yml create mode 100644 macros/splunkd.yml create mode 100644 macros/splunkd_failed_auths.yml create mode 100644 macros/splunkd_ui.yml create mode 100644 macros/splunkda.yml create mode 100644 removed/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml create mode 100644 removed/detections/detect_risky_spl_using_pretrained_ml_model.yml create mode 100644 removed/detections/open_redirect_in_splunk_web.yml create mode 100644 removed/detections/path_traversal_spl_injection.yml create mode 100644 removed/detections/persistent_xss_in_rapiddiag_through_user_interface_views.yml create mode 100644 removed/detections/splunk_absolute_path_traversal_using_runshellscript.yml create mode 100644 removed/detections/splunk_account_discovery_drilldown_dashboard_disclosure.yml create mode 100644 removed/detections/splunk_command_and_scripting_interpreter_delete_usage.yml create mode 100644 removed/detections/splunk_command_and_scripting_interpreter_risky_commands.yml create mode 100644 removed/detections/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml create mode 100644 removed/detections/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml create mode 100644 removed/detections/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml create mode 100644 removed/detections/splunk_digital_certificates_infrastructure_version.yml create mode 100644 removed/detections/splunk_digital_certificates_lack_of_encryption.yml create mode 100644 removed/detections/splunk_disable_kvstore_via_csrf_enabling_maintenance_mode.yml create mode 100644 removed/detections/splunk_dos_using_malformed_saml_request.yml create mode 100644 removed/detections/splunk_dos_via_dump_spl_command.yml create mode 100644 removed/detections/splunk_dos_via_malformed_s2s_request.yml create mode 100644 removed/detections/splunk_dos_via_post_request_datamodel_endpoint.yml create mode 100644 removed/detections/splunk_dos_via_printf_search_function.yml create mode 100644 removed/detections/splunk_edit_user_privilege_escalation.yml create mode 100644 removed/detections/splunk_endpoint_denial_of_service_dos_zip_bomb.yml create mode 100644 removed/detections/splunk_enterprise_information_disclosure.yml create mode 100644 removed/detections/splunk_enterprise_windows_deserialization_file_partition.yml create mode 100644 removed/detections/splunk_es_dos_investigations_manager_via_investigation_creation.yml create mode 100644 removed/detections/splunk_es_dos_through_investigation_attachments.yml create mode 100644 removed/detections/splunk_http_response_splitting_via_rest_spl_command.yml create mode 100644 removed/detections/splunk_identified_ssl_tls_certificates.yml create mode 100644 removed/detections/splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard.yml create mode 100644 removed/detections/splunk_improperly_formatted_parameter_crashes_splunkd.yml create mode 100644 removed/detections/splunk_information_disclosure_in_splunk_add_on_builder.yml create mode 100644 removed/detections/splunk_list_all_nonstandard_admin_accounts.yml create mode 100644 removed/detections/splunk_low_priv_search_as_nobody_splunkdeploymentserverconfig_app.yml create mode 100644 removed/detections/splunk_low_privilege_user_can_view_hashed_splunk_password.yml create mode 100644 removed/detections/splunk_persistent_xss_via_props_conf.yml create mode 100644 removed/detections/splunk_persistent_xss_via_scheduled_views.yml create mode 100644 removed/detections/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml create mode 100644 removed/detections/splunk_process_injection_forwarder_bundle_downloads.yml create mode 100644 removed/detections/splunk_protocol_impersonation_weak_encryption_configuration.yml create mode 100644 removed/detections/splunk_protocol_impersonation_weak_encryption_selfsigned.yml create mode 100644 removed/detections/splunk_protocol_impersonation_weak_encryption_simplerequest.yml create mode 100644 removed/detections/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml create mode 100644 removed/detections/splunk_rce_via_external_lookup_copybuckets.yml create mode 100644 removed/detections/splunk_rce_via_serialized_session_payload.yml create mode 100644 removed/detections/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml create mode 100644 removed/detections/splunk_reflected_xss_in_the_templates_lists_radio.yml create mode 100644 removed/detections/splunk_reflected_xss_on_app_search_table_endpoint.yml create mode 100644 removed/detections/splunk_risky_command_abuse_disclosed_february_2023.yml create mode 100644 removed/detections/splunk_sg_information_disclosure_for_low_privs_user.yml create mode 100644 removed/detections/splunk_stored_xss_conf_web_settings_on_premises.yml create mode 100644 removed/detections/splunk_stored_xss_via_data_model_objectname_field.yml create mode 100644 removed/detections/splunk_stored_xss_via_specially_crafted_bulletin_message.yml create mode 100644 removed/detections/splunk_unauthenticated_dos_via_null_pointer_references.yml create mode 100644 removed/detections/splunk_unauthenticated_log_injection_web_service_log.yml create mode 100644 removed/detections/splunk_unauthenticated_path_traversal_modules_messaging.yml create mode 100644 removed/detections/splunk_unauthorized_experimental_items_creation.yml create mode 100644 removed/detections/splunk_unauthorized_notification_input_by_user.yml create mode 100644 removed/detections/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml create mode 100644 removed/detections/splunk_xss_in_highlighted_json_events.yml create mode 100644 removed/detections/splunk_xss_in_monitoring_console.yml create mode 100644 removed/detections/splunk_xss_in_save_table_dialog_header_in_search_page.yml create mode 100644 removed/detections/splunk_xss_via_external_urls_in_dashboards_ssrf.yml create mode 100644 removed/detections/splunk_xss_via_view.yml create mode 100644 stories/splunk_vulnerabilities.yml diff --git a/.gitignore b/.gitignore index 2a6e590e07..5133d1798e 100644 --- a/.gitignore +++ b/.gitignore @@ -13,6 +13,7 @@ dist/ContentPack-*.appinspect_api_results.html dist/ContentPack-*.appinspect_api_results.json atomic-red-team/ external_repos/ +schemas/ # IDE .vscode/ diff --git a/detections/application/splunk_authentication_token_exposure_in_debug_log.yml b/detections/application/splunk_authentication_token_exposure_in_debug_log.yml new file mode 100644 index 0000000000..d056f65a60 --- /dev/null +++ b/detections/application/splunk_authentication_token_exposure_in_debug_log.yml @@ -0,0 +1,70 @@ +name: Splunk Authentication Token Exposure in Debug Log +id: 9a67e749-d291-40dd-8376-d422e7ecf8b5 +version: 9 +creation_date: '2024-03-27' +modification_date: '2026-06-24' +author: Rod Soto, Chase Franklin +status: production +type: TTP +description: |- + The following analytic identifies exposed authentication tokens in debug logs within Splunk Enterprise. + It leverages logs from the `splunkd` component with a DEBUG log level, specifically searching for event messages that validate tokens. This activity is significant because exposed tokens can be exploited by attackers to gain unauthorized access to the Splunk environment. + If confirmed malicious, this exposure could lead to unauthorized data access, privilege escalation, and potential compromise of the entire Splunk infrastructure. + Monitoring and addressing this vulnerability is crucial for maintaining the security and integrity of the Splunk deployment. +data_source: [] +search: |- + `splunkd` + component=JsonWebToken + log_level=DEBUG + eventtype="splunkd-log" + event_message="Validating token:*" + | rex "Validating token: (?.*)\.$" + | search token!=None + | stats count min(_time) as firstTime + max(_time) as lastTime + values(log_level) as log_level + values(event_message) as event_message + by index, sourcetype, host, token + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_authentication_token_exposure_in_debug_log_filter` +how_to_implement: Requires access to internal Splunk indexes. +known_false_positives: Only applies to affected versions of Splunk Enterprise below 9.2.1, 9.1.4, and 9.0.9 +references: + - https://advisory.splunk.com/advisories/SVD-2024-0301 +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Possible JsonWebToken exposure, please investigate affected $host$ + entity: + field: host + type: system + score: 50 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-29945 +mitre_attack_id: + - T1654 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/splunk/jsonwebtokenplaintokensvd_splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + index: _internal + test_type: unit diff --git a/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml new file mode 100644 index 0000000000..74c716a688 --- /dev/null +++ b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml @@ -0,0 +1,80 @@ +name: Splunk RCE Through Arbitrary File Write to Windows System Root +id: c97e0704-d9c6-454d-89ba-1510a987bf72 +version: 7 +creation_date: '2024-10-14' +modification_date: '2026-06-23' +author: Rod Soto +status: production +type: Hunting +description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration. +data_source: + - Splunk +search: |- + ```Each exploit attempt abuses the following endpoint. A request to the endpoint MUST occur immediately before the App Creation Message. However, this endpoint does not expose the name of the app that was created``` + `splunkda` status=200 uri_path="*/search/apps/local/_new" + | bin _time span=1m | stats count by _time, user + ``` A request to this endpoint also results in an ApplicationManager event showing that a new application was created. This exposes the name and is created immediately following the initial request. We will look for these creation messages up to 60 seconds after the request to the vulnerable endpoint.``` + | eval earliest_app_creation_time=_time + | eval latest_app_creation_time=_time+60 + | eval api_user=user + ```Search for the names of apps that were created with the time bounds above``` + | map maxsearches=150 search="search index=_internal earliest=$earliest_app_creation_time$ latest=$latest_app_creation_time$ + ```Admins, or users with app creation privileges may abuse this command``` + (sourcetype=splunkd component=ApplicationManager event_message=\"Detected app creation:*\") OR + ```But the command may also be abused by users with lower privileges``` + (sourcetype=splunk_python user=$api_user$ type=ERROR \"requires capability\" AND (\"edit_local_apps\" OR \"admin_all_objects\")) + ```Create meaningful messages in the case that app creation was successful or if it failed``` + | strcat event_message \" - This app should be examined to ensure that it is legitimate.\" message_if_app_creation_successful + | strcat event_message \"Detected failed app creation: user does not have admin_all_objects or edit_local_apps capability and the user account MUST be investigated. This may still have resulted in the upload of malicious file(s) or execution of maliciouis command(s).\" message_if_app_creation_failed + | eval message=if(isnull(event_message), message_if_app_creation_failed, message_if_app_creation_successful ) + | eval user=\"$api_user$\"" + | stats count min(_time) as firstTime max(_time) as lastTime by user, message, host + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_rce_through_arbitrary_file_write_to_windows_system_root_filter` +how_to_implement: This search requires access to the _internal index and only applies Splunk Enterprise installations on Microsoft Windows. Apps, messages, and/or users reported by the search should be analyzed to see if they are legitimate. +known_false_positives: This search may produce false positives as it is not possible to analyze the contents of an App Creation. This only applies to Splunk installations on Microsoft Windows where installation is placed on a different root directory like e or d. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1001 + - https://advisory.splunk.com/advisories/SVD-2024-1003 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-45731 + - CVE-2024-45733 +mitre_attack_id: + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test SVD 1001 + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunkd.log + sourcetype: splunkd + source: D:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd.log + index: _internal + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunkd_access.log + sourcetype: splunkd_access + source: D:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd_access.log + index: _internal + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunk_python.log + sourcetype: splunk_python + source: D:\\Program Files\\Splunk\\var\\log\\splunk\\python.log + index: _internal + test_type: unit + - name: True Positive Test SVD 1003 + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1003-index_internal_sourcetype_splunkd_access.log + sourcetype: splunkd_access + source: C:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd_access.log + index: _internal + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1003-index_internal_sourcetype_splunk_python.log + sourcetype: splunk_python + source: C:\\Program Files\\Splunk\\var\\log\\splunk\\python.log + index: _internal + test_type: unit diff --git a/detections/application/splunk_rce_via_user_xslt.yml b/detections/application/splunk_rce_via_user_xslt.yml new file mode 100644 index 0000000000..3f97d77828 --- /dev/null +++ b/detections/application/splunk_rce_via_user_xslt.yml @@ -0,0 +1,36 @@ +name: Splunk RCE via User XSLT +id: 6cb7e011-55fb-48e3-a98d-164fa854e37e +version: 7 +creation_date: '2023-11-22' +modification_date: '2026-05-14' +author: Marissa Bower, Chase Franklin, Rod Soto, Bhavin Patel, Eric McGinnis, Splunk +status: production +type: Hunting +description: The following analytic identifies potential remote code execution (RCE) attempts via user-supplied Extensible Stylesheet Language Transformations (XSLT) in Splunk versions 9.1.x. It detects this activity by analyzing `splunkd_ui` logs for specific URI patterns and status codes indicative of XSLT injection attempts. This activity is significant because successful exploitation could allow an attacker to execute arbitrary code on the Splunk server. If confirmed malicious, this could lead to full system compromise, unauthorized data access, and further lateral movement within the network. +data_source: [] +search: '`splunkd_ui` ((uri="*NO_BINARY_CHECK=1*" AND "*input.path=*.xsl*") OR uri="*dispatch*.xsl*") AND uri!= "*splunkd_ui*" | rex field=uri "(?=\s*([\S\s]+))" | eval decoded_field=urldecode(string) | eval action=case(match(status,"200"),"Allowed",match(status,"303|500|401|403|404|301|406"),"Blocked",1=1,"Unknown") | stats count min(_time) as firstTime max(_time) as lastTime by clientip useragent uri decoded_field action host | rename clientip as src, uri as dest_uri | iplocation src | fillnull value="N/A" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime, lastTime src, useragent, action, count, Country, Region, City, dest_uri, decoded_field | `splunk_rce_via_user_xslt_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. +known_false_positives: This search will provide information for investigation and hunting possible abuse of user-supplied XSLT. There may be false positives and results should individually evaluated. Please evaluate the source IP and useragent responsible for creating the requests. +references: + - https://advisory.splunk.com/advisories/SVD-2023-1104 +analytic_story: + - Splunk Vulnerabilities +asset_type: Endpoint +cve: + - CVE-2023-46214 +mitre_attack_id: + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_user_xslt_splunkd_ui_access.log + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log + sourcetype: splunkd_ui_access + index: _internal + test_type: unit diff --git a/detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml b/detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml new file mode 100644 index 0000000000..0667d0860e --- /dev/null +++ b/detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml @@ -0,0 +1,60 @@ +name: Splunk Sensitive Information Disclosure in DEBUG Logging Channels +id: 93dc7182-c5da-4085-82ec-401abf33d623 +version: 6 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Splunk +status: production +type: Hunting +description: In Splunk versions 9.3, 9.2, 9.1, 9.1.5 Applications which have been enabled with logging level DEBUG may write sensitive information such as keys, tokens, or other sensitive strings into the internal index. +data_source: + - Splunk +search: |- + `splunkd` log_level="DEBUG" AND component IN ("REST_Calls", "AdminManager", "JSONWebToken") + | stats count min(_time) as firstTime max(_time) as lastTime by host splunk_server log_level component event_message + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_sensitive_information_disclosure_in_debug_logging_channels_filter` +how_to_implement: Requires access to _internal index. It is recommended to inventory and modify the search for specific apps that may have DEBUG logging enabled. +known_false_positives: There will be false positives as not every message to the DEBUG log will expose sensitive information, such as keys or other secrets. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0301 + - https://advisory.splunk.com/advisories/SVD-2024-1008 + - https://advisory.splunk.com/advisories/SVD-2024-1009 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-29945 + - CVE-2024-45738 + - CVE-2024-45739 +mitre_attack_id: + - T1552 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test of JsonWebToken DEBUG Logging Channel + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/splunk/jsonwebtokenplaintokensvd_splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + index: _internal + test_type: unit + - name: True Positive Test of REST_Calls DEBUG Logging Channel + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/splunk/svd-2024-1008.log + sourcetype: splunkd + source: /opt/splunk/var/log/splunk/splunkd.log + index: _internal + test_type: unit + - name: True Positive Test of AdminManager DEBUG Logging Channel + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/splunk/svd-2024-1009.log + sourcetype: splunkd + source: /opt/splunk/var/log/splunk/splunkd.log + index: _internal + test_type: unit diff --git a/detections/application/splunk_user_enumeration_attempt.yml b/detections/application/splunk_user_enumeration_attempt.yml new file mode 100644 index 0000000000..c3ddfefac3 --- /dev/null +++ b/detections/application/splunk_user_enumeration_attempt.yml @@ -0,0 +1,55 @@ +name: Splunk User Enumeration Attempt +id: 25625cb4-1c4d-4463-b0f9-7cb462699cde +version: 9 +creation_date: '2022-04-29' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: production +type: TTP +description: The following analytic identifies attempts to enumerate usernames in Splunk by detecting multiple failed authentication attempts from the same source. It leverages data from the `_audit` index, specifically focusing on failed authentication events. This activity is significant for a SOC because it can indicate an attacker trying to discover valid usernames, which is a precursor to more targeted attacks like password spraying or brute force attempts. If confirmed malicious, this activity could lead to unauthorized access, compromising the security of the Splunk environment and potentially exposing sensitive data. +data_source: + - Splunk +search: '`splunkd_failed_auths` | stats count(user) as auths by user, src | where auths>5 | stats values(user) as user, sum(auths) as TotalFailedAuths by src | `splunk_user_enumeration_attempt_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames. +known_false_positives: Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected. + entity: + field: user + type: user + score: 40 +threat_objects: + - field: src + type: ip_address +analytic_story: + - Splunk Vulnerabilities +asset_type: Endpoint +cve: + - CVE-2021-33845 +mitre_attack_id: + - T1078 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: access +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log + source: audittrail + sourcetype: audittrail + index: _audit + test_type: unit diff --git a/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml b/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml new file mode 100644 index 0000000000..68e0178387 --- /dev/null +++ b/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml @@ -0,0 +1,41 @@ +name: Splunk XSS Privilege Escalation via Custom Urls in Dashboard +id: 01e1e386-7656-4f36-a55a-52fe39b04a96 +version: 7 +creation_date: '2024-07-01' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: production +type: Hunting +description: This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges. +data_source: + - Splunk +search: '`splunkd_ui` method=POST /*/data/ui/views* | stats values(method) as method by _time index, sourcetype, host | eval event="post_request" | append [| search `audittrail` action="edit_user" operation="create" | rex field=_raw "object=\"(?.*)\"" | stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser | eval event="create_user"] | sort - _time | transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m | table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount | `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`' +how_to_implement: Requires access to internal indexes _audit and _internal. +known_false_positives: This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime. +references: + - https://advisory.splunk.com/ +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-36992 +mitre_attack_id: + - T1189 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0712_splunkd_ui_access_splunk_ui_access.log + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log + sourcetype: splunkd_ui_access + index: _internal + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0712_audittrail_audittrail.log + source: /opt/splunk/var/log/splunk/audittrail + sourcetype: audittrail + index: _audit + test_type: unit diff --git a/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml b/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml new file mode 100644 index 0000000000..a377c05c21 --- /dev/null +++ b/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml @@ -0,0 +1,32 @@ +name: Splunk App for Lookup File Editing RCE via User XSLT +id: a053e6a6-2146-483a-9798-2d43652f3299 +version: 8 +creation_date: '2023-11-16' +modification_date: '2026-06-24' +author: Rod Soto, Splunk +status: deprecated +type: Hunting +description: The following analytic identifies the creation of lookup files in Splunk, which could indicate an attempt to exploit remote code execution via user-supplied XSLT. It leverages REST API queries to monitor the creation of these lookups, focusing on fields such as title, author, and access control lists. This activity is significant because it targets a known vulnerability in Splunk versions 9.1.x, potentially allowing attackers to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, compromising the integrity and security of the Splunk environment. +data_source: [] +search: '| rest splunk_server=local /services/data/lookup-table-files/ | fields title author disabled eai:acl.app eai:acl.owner eai:acl.sharing eai:appName eai:data | `splunk_app_for_lookup_file_editing_rce_via_user_xslt_filter`' +how_to_implement: Because there is no way to detect the payload, this search only provides the ability to monitor the creation of lookups which are the base of this exploit. An operator must then investigate suspicious lookups. This search requires ability to perform REST queries. Note that if the Splunk App for Lookup File Editing is not, or was not, installed in the Splunk environment then it is not necessary to run the search as the enviornment was not vulnerable. +known_false_positives: This search will provide information for investigation and hunting of lookup creation via user-supplied XSLT which may be indications of possible exploitation. There will be false positives as it is not possible to detect the payload executed via this exploit. +references: + - https://advisory.splunk.com/advisories/SVD-2023-1104 +analytic_story: + - Splunk Vulnerabilities +asset_type: Endpoint +cve: + - CVE-2023-46214 +mitre_attack_id: + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +deprecation_info: + reason: Detection has been deprecated because it's too generic and does not provide the ability to detect the payload executed via this exploit. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml b/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml new file mode 100644 index 0000000000..16c8972fdd --- /dev/null +++ b/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml @@ -0,0 +1,40 @@ +name: Splunk Code Injection via custom dashboard leading to RCE +id: b06b41d7-9570-4985-8137-0784f582a1b3 +version: 8 +creation_date: '2022-12-19' +modification_date: '2026-06-24' +author: Rod Soto +status: deprecated +type: Hunting +description: The following analytic identifies attempts to exploit a vulnerability in Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, where an authenticated user can execute arbitrary code via the dashboard PDF generation component. It detects this activity by analyzing events in the _internal index with the file=export parameter. This behavior is significant because it indicates a potential code injection attack, which could lead to remote code execution (RCE). If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary commands, and potentially compromise the entire Splunk environment. +data_source: [] +search: '`splunkd_ui` uri_path=*/data/ui/views/* OR uri_path=*saved/searches/* | dedup uri_path | eval URL=urldecode("uri_path")| rex field=URL "\/saved\/searches\/(?[^\/]*)" | rex field=URL "\/data\/ui\/views\/(?[^\/]*)" | eval NAME=NAME."( Saved Search )",NAME1=NAME1."( Dashboard )" | eval NAME=coalesce(NAME,NAME1) | eval STATUS=case(match(status,"2\d+"),"SUCCESS",match(status,"3\d+"),"REDIRECTION",match(status,"4\d+") OR match(status,"5\d+"),"ERROR") | stats list(NAME) as DASHBOARD_TITLE,list(method) as HTTP_METHOD,list(status) as Status_Code,list(STATUS) as STATUS by user | rename user as User | `splunk_code_injection_via_custom_dashboard_leading_to_rce_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. +known_false_positives: Not all exports and downloads are malicious, special attention must be put as well on /en-US/splunkd/__raw/services/pdfgen/render in the context of this search. +references: + - https://www.splunk.com/en_us/product-security.html +analytic_story: + - Splunk Vulnerabilities +asset_type: Endpoint +cve: + - CVE-2022-43571 +mitre_attack_id: + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_code_injection_via_custom_dashboard_leading_to_rce.log + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log + sourcetype: splunkd_ui_access + index: _internal + test_type: unit +deprecation_info: + reason: Detection has been deprecated. The affected Splunk software versions (8.1.12, 8.2.9, and 9.0.2) are no longer supported, having reached End of Life (EOL) between 2023 and 2024. Also, the logic is not perfectly capturing the malicious activity. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml b/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml new file mode 100644 index 0000000000..048f7f1d47 --- /dev/null +++ b/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml @@ -0,0 +1,41 @@ +name: Splunk Enterprise KV Store Incorrect Authorization +id: 8f0e8380-a835-4f2b-b749-9ce119364df0 +version: 9 +creation_date: '2024-01-22' +modification_date: '2026-06-24' +author: Rod Soto, Eric McGinnis, Chase Franklin +status: deprecated +type: Hunting +description: The following analytic detects unauthorized attempts to reload Splunk KV Store collections via the REST API. It leverages internal index logs to identify POST requests to the `/servicesNS/nobody/search/admin/collections-conf/_reload` endpoint, focusing on status codes starting with '2'. This activity is significant as it may indicate improper permission handling, potentially leading to unauthorized deletion of KV Store collections. If confirmed malicious, this could result in data loss or unauthorized data manipulation, impacting the integrity and availability of critical Splunk data. +data_source: + - Splunk +search: '`splunkda` uri=/servicesNS/nobody/search/admin/collections-conf/_reload status=2* method="POST" user=* file=_reload | stats count min(_time) as firstTime max(_time) as lastTime values(status) as status by host clientip file method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_kv_store_incorrect_authorization_filter`' +how_to_implement: Requires access to internal indexes and REST API enabled instances. +known_false_positives: This is a hunting search and will produce false positives. Operator must follow results into instances where curl requests coming from actual users may indicate intent of exploitation. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0105 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-23675 +mitre_attack_id: + - T1548 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_enterprise_kv_store_incorrect_authorization_splunkd_access.log + source: /opt/splunk/var/log/splunk/splunkd_access.log + sourcetype: splunkd_access + index: _internal + test_type: unit +deprecation_info: + reason: Detection has been deprecated. The affected Splunk software versions (below 9.0.8 and 9.1.3)are no longer supported, having reached End of Life (EOL), and the logic is not accurately detecting the malicious activity. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/deprecated/splunk_information_disclosure_on_account_login.yml b/detections/deprecated/splunk_information_disclosure_on_account_login.yml new file mode 100644 index 0000000000..2e3d38b171 --- /dev/null +++ b/detections/deprecated/splunk_information_disclosure_on_account_login.yml @@ -0,0 +1,41 @@ +name: Splunk Information Disclosure on Account Login +id: 2bae5d19-6d1b-4db0-82ab-0af5ac5f836c +version: 8 +creation_date: '2024-07-01' +modification_date: '2026-06-24' +author: Rod Soto +status: deprecated +type: Hunting +description: This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server. +data_source: + - Splunk +search: '`splunkd` component=UiAuth status=failure action=login TcpChannelThread | stats count min(_time) as firstTime max(_time) as lastTime by user status action clientip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_information_disclosure_on_account_login_filter`' +how_to_implement: Requires access to internal indexes _internal. +known_false_positives: This is a hunting search and requires operator to search for large number of login failures from several users indicating possible user enumeration attempts. May capture genuine login failures. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0716 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-36996 +mitre_attack_id: + - T1087 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/splunk/SVD-2024-0716_splunkd_splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + index: _internal + test_type: unit +deprecation_info: + reason: Detection has been deprecated. The logic is not accurately detecting the malicious activity. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml b/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml new file mode 100644 index 0000000000..ec3f314307 --- /dev/null +++ b/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml @@ -0,0 +1,39 @@ +name: Splunk Path Traversal In Splunk App For Lookup File Edit +id: 8ed58987-738d-4917-9e44-b8ef6ab948a6 +version: 9 +creation_date: '2023-06-01' +modification_date: '2026-06-24' +author: Rod Soto, Eric McGinnis +status: deprecated +type: Hunting +description: The following analytic identifies path traversal attempts in the Splunk App for Lookup File Editing. It detects specially crafted web requests targeting lookup files by analyzing the `uri_query` field in the `_internal` index. This activity is significant because it allows low-privilege users to read and write to restricted areas of the Splunk installation directory, potentially accessing sensitive files like password hashes. If confirmed malicious, this could lead to unauthorized access, data breaches, and further exploitation of the Splunk environment. +data_source: + - Splunk +search: '`splunkda` uri_query=*lookup_file* | table clientip uri_query lookup_file owner namespace version | stats count by clientip namespace lookup_file uri_query | `splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests. +known_false_positives: This search may find additional path traversal exploitation attempts or malformed requests. +references: + - https://advisory.splunk.com/ +analytic_story: + - Splunk Vulnerabilities +asset_type: Endpoint +mitre_attack_id: + - T1083 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.log + source: splunkd_access + sourcetype: splunkd_access + index: _internal + test_type: unit +deprecation_info: + reason: Detection has been deprecated. The logic is not accurately detecting the malicious activity. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/deprecated/splunk_rce_pdfgen_render.yml b/detections/deprecated/splunk_rce_pdfgen_render.yml new file mode 100644 index 0000000000..666040de17 --- /dev/null +++ b/detections/deprecated/splunk_rce_pdfgen_render.yml @@ -0,0 +1,56 @@ +name: Splunk RCE PDFgen Render +id: bc2b7437-0400-438b-9537-21ab5b7d2d53 +version: 8 +creation_date: '2024-07-01' +modification_date: '2026-06-24' +author: Rod Soto, Chase Franklin +status: deprecated +type: TTP +description: This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote +data_source: + - Splunk +search: index=_internal sourcetype=splunk_pdfgen _raw IN ("*base64*", "*lambda*", "*system*") | stats count min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host, _raw | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_rce_pdfgen_render_filter` +how_to_implement: Requires access to internal indexes. +known_false_positives: This search will hunt for exploitation attempts against Splunk PDFgen render function, and not all requests are necesarily malicious so there will be false positives. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0701 +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Possible exploitation against $host$ + entity: + field: host + type: system + score: 80 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-36982 +mitre_attack_id: + - T1210 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0701_pdfgen_log_splunk_pdfgen.log + source: /opt/splunk/var/log/splunk/pdfgen.log + sourcetype: splunk_pdfgen + index: _internal + test_type: unit +deprecation_info: + reason: Detection has been deprecated. The metadata along with the search are not accurately capturing the malicious activity. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/lookups/csv/splunk_risky_command.csv b/lookups/csv/splunk_risky_command.csv new file mode 100644 index 0000000000..a26d6aaba1 --- /dev/null +++ b/lookups/csv/splunk_risky_command.csv @@ -0,0 +1,16 @@ +"splunk_risky_command","description","vulnerable_versions","CVE" +"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931" +"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934" +"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936" +"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939" +"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935" +"*|*runshellscript*","runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards; +runshellscript may be abused to exploit legacy internal functions in external lookups leading to arbitrary code execution","<8.1.14, <8.2.12, <9.0.6, <9.1.1; +<8.2.12, <9.0.6, <9.1.1","CVE-2023-40598, CVE-2023-46214" +"*|*mrollup*","The “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.","<9.0.8, <9.1.3, <9.1.2308.200","CVE-2024-23676" +"*|*mstats*","The ""mstats"" SPL command lets malicious user can control a search query in Analytics Workspace using params from another search (via job SID) and quotation mark ' ' and "" incorrect handling","<9.0.10, <9.1.5, <9.2.2","CVE-2024-36984" \ No newline at end of file diff --git a/lookups/csv/splunk_risky_command.yml b/lookups/csv/splunk_risky_command.yml new file mode 100644 index 0000000000..60b07f3ecc --- /dev/null +++ b/lookups/csv/splunk_risky_command.yml @@ -0,0 +1,13 @@ +name: splunk_risky_command +id: 86e4521f-a57d-430b-9d5f-1547afabc618 +version: 3 +creation_date: '2023-02-14' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of Risky Splunk Command that are candidates for abuse +default_match: 'false' +match_type: + - WILDCARD(splunk_risky_command) +min_matches: 1 +case_sensitive_match: 'false' diff --git a/macros/audittrail.yml b/macros/audittrail.yml new file mode 100644 index 0000000000..0380788d01 --- /dev/null +++ b/macros/audittrail.yml @@ -0,0 +1,8 @@ +name: audittrail +id: ef23f92d-2795-462b-b5c1-632d626f4f2f +version: 1 +creation_date: '2023-06-01' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: Macro to enable easy searching of audittrail logs +definition: index=_audit sourcetype=audittrail diff --git a/macros/deprecated/audit_searches.yml b/macros/deprecated/audit_searches.yml new file mode 100644 index 0000000000..0ad583b452 --- /dev/null +++ b/macros/deprecated/audit_searches.yml @@ -0,0 +1,8 @@ +name: audit_searches +id: 4e72f7fe-b952-446b-b2bd-dab0c2e21b29 +version: 1 +creation_date: '2022-11-01' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: Macro to enable easy searching of audittrail logs for searches +definition: index=_audit sourcetype=audittrail action=search diff --git a/macros/deprecated/bro_ssl_json.yml b/macros/deprecated/bro_ssl_json.yml new file mode 100644 index 0000000000..3245c7aa6b --- /dev/null +++ b/macros/deprecated/bro_ssl_json.yml @@ -0,0 +1,8 @@ +name: bro_ssl_json +id: 41a8cbf6-82a8-4fb8-a455-4f032c7f6e9e +version: 1 +creation_date: '2020-04-30' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. +definition: sourcetype=bro:ssl:json diff --git a/macros/deprecated/path_traversal_spl_injection.yml b/macros/deprecated/path_traversal_spl_injection.yml new file mode 100644 index 0000000000..28a4d9a0ab --- /dev/null +++ b/macros/deprecated/path_traversal_spl_injection.yml @@ -0,0 +1,8 @@ +name: path_traversal_spl_injection +id: 60ccecaf-83b4-4e3b-ba93-9532cad57965 +version: 1 +creation_date: '2019-12-17' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunkd_ui_access diff --git a/macros/deprecated/splunk_crash_log.yml b/macros/deprecated/splunk_crash_log.yml new file mode 100644 index 0000000000..6e43b34265 --- /dev/null +++ b/macros/deprecated/splunk_crash_log.yml @@ -0,0 +1,8 @@ +name: splunk_crash_log +id: c7ef6717-771d-46f0-a8e0-3a2bc275863f +version: 1 +creation_date: '2023-06-01' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: Searches through the Splunk Crash Log for low-level errors and crashes +definition: (index=_internal AND sourcetype=splunkd_crash_log) diff --git a/macros/deprecated/splunk_python.yml b/macros/deprecated/splunk_python.yml new file mode 100644 index 0000000000..b1835be509 --- /dev/null +++ b/macros/deprecated/splunk_python.yml @@ -0,0 +1,8 @@ +name: splunk_python +id: 1b3b6a72-b2d9-453e-a97b-40945d4f5fb3 +version: 1 +creation_date: '2019-12-17' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunk_python diff --git a/macros/deprecated/splunkd_investigation_rest_handler.yml b/macros/deprecated/splunkd_investigation_rest_handler.yml new file mode 100644 index 0000000000..4a4816d948 --- /dev/null +++ b/macros/deprecated/splunkd_investigation_rest_handler.yml @@ -0,0 +1,8 @@ +name: splunkd_investigation_rest_handler +id: cf35d3df-3a59-480d-af40-ea29b796469c +version: 1 +creation_date: '2020-04-30' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=investigation_rest_handler diff --git a/macros/deprecated/splunkd_web.yml b/macros/deprecated/splunkd_web.yml new file mode 100644 index 0000000000..dd367182e4 --- /dev/null +++ b/macros/deprecated/splunkd_web.yml @@ -0,0 +1,8 @@ +name: splunkd_web +id: 0c57824b-6e05-4d98-b2a0-c358b6a94a42 +version: 1 +creation_date: '2020-05-05' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunk_web_access diff --git a/macros/deprecated/splunkd_webs.yml b/macros/deprecated/splunkd_webs.yml new file mode 100644 index 0000000000..35e2bf3837 --- /dev/null +++ b/macros/deprecated/splunkd_webs.yml @@ -0,0 +1,8 @@ +name: splunkd_webs +id: ddde1939-77e0-4ef4-b13d-5c0256401063 +version: 1 +creation_date: '2020-04-30' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunk_web_service diff --git a/macros/deprecated/splunkd_webx.yml b/macros/deprecated/splunkd_webx.yml new file mode 100644 index 0000000000..2e687bd78a --- /dev/null +++ b/macros/deprecated/splunkd_webx.yml @@ -0,0 +1,8 @@ +name: splunkd_webx +id: 218048bf-6eb0-4eed-8164-c1baa1039a23 +version: 1 +creation_date: '2020-05-05' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunk_web_access diff --git a/macros/splunkd.yml b/macros/splunkd.yml new file mode 100644 index 0000000000..ee4a5f00a3 --- /dev/null +++ b/macros/splunkd.yml @@ -0,0 +1,8 @@ +name: splunkd +id: 2ccba0af-81ac-4d79-9e52-be64380d69fd +version: 1 +creation_date: '2020-04-30' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunkd diff --git a/macros/splunkd_failed_auths.yml b/macros/splunkd_failed_auths.yml new file mode 100644 index 0000000000..bdfeacb8d9 --- /dev/null +++ b/macros/splunkd_failed_auths.yml @@ -0,0 +1,8 @@ +name: splunkd_failed_auths +id: d11b825f-2462-4b35-83ec-17059d74f6a7 +version: 1 +creation_date: '2020-05-05' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_audit "action=login attempt" "info=failed" diff --git a/macros/splunkd_ui.yml b/macros/splunkd_ui.yml new file mode 100644 index 0000000000..ef8a25de18 --- /dev/null +++ b/macros/splunkd_ui.yml @@ -0,0 +1,8 @@ +name: splunkd_ui +id: 3c0d1a01-8775-4d32-9f57-ad6106081968 +version: 1 +creation_date: '2020-05-05' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunkd_ui_access diff --git a/macros/splunkda.yml b/macros/splunkda.yml new file mode 100644 index 0000000000..606d93bcc9 --- /dev/null +++ b/macros/splunkda.yml @@ -0,0 +1,8 @@ +name: splunkda +id: 7b9bd08e-002a-4b99-a89e-711c4300acb5 +version: 1 +creation_date: '2020-05-05' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunkd_access diff --git a/removed/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/removed/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml new file mode 100644 index 0000000000..6812d0e17f --- /dev/null +++ b/removed/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -0,0 +1,34 @@ +name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline +id: 273df2f7-643a-451a-8d4d-637e39eadc87 +version: 3 +creation_date: '2022-06-13' +modification_date: '2026-05-14' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Baseline +status: removed +description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://help.splunk.com/en/splunk-enterprise-security-8/splunk-machine-learning-toolkit/machine-learning-toolkit-user-guide/5.5.0/mltk-models/creating-sharing-and-deleting-models-in-the-splunk-machine-learning-toolkit unless the same account of training this model will be used to perform inference using this model for anomaly detection.' +search: '| tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) AND (Search_Activity.search IN ( "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true by Search_Activity.user into "risky_command_abuse" ' +how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky SPL MLTK". This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might take significant computing resources. It might require dedicated search head. The underlined machine learning algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction parameters can be found here - https://help.splunk.com/en/splunk-enterprise-security-8/splunk-machine-learning-toolkit/machine-learning-toolkit-user-guide/5.5.0/algorithms-and-scoring-metrics-in-mltk/configure-algorithm-performance-costs Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points to build a good baseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better suit users' violation policy and their usage environment. +known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. +references: + - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands +tags: + analytic_story: + - Splunk Vulnerabilities + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit + detections: + - Splunk Command and Scripting Interpreter Risky SPL MLTK +deployment: + scheduling: + cron_schedule: 55 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto +deprecation_info: + reason: Baseline is deprecated as the associated detection is deprecated. + removed_in_version: 5.12.0 + replacement_content: [] diff --git a/removed/detections/detect_risky_spl_using_pretrained_ml_model.yml b/removed/detections/detect_risky_spl_using_pretrained_ml_model.yml new file mode 100644 index 0000000000..5b9e58aca3 --- /dev/null +++ b/removed/detections/detect_risky_spl_using_pretrained_ml_model.yml @@ -0,0 +1,46 @@ +name: Detect Risky SPL using Pretrained ML Model +id: b4aefb5f-1037-410d-a149-1e091288ba33 +version: 6 +creation_date: '2022-06-21' +modification_date: '2026-05-14' +author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk +status: removed +type: Anomaly +description: The following analytic identifies potentially risky SPL commands executed by users. It leverages a pretrained machine learning text classifier that analyzes command text, user, and search type to assign a risk score between 0 and 1. This detection is significant as it helps identify suspicious or unauthorized search activities that could indicate malicious intent or misuse of the Splunk environment. If confirmed malicious, such activity could lead to unauthorized data access, data exfiltration, or further exploitation of the system. +data_source: [] +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type | eval spl_text = ''Search_Activity.search''. " " .''Search_Activity.user''. " " .''Search_Activity.search_type''| dedup spl_text | apply risky_spl_pre_trained_model | where risk_score > 0.5 | `drop_dm_object_name(Search_Activity)` | table search, user, search_type, risk_score | `detect_risky_spl_using_pretrained_ml_model_filter`' +how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. The detection uses a custom MLTK model hence we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb. +known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. +references: + - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands +rba: + message: A potentially risky Splunk command has been run by $user$, kindly review. + risk_objects: + - field: user + type: user + score: 20 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cve: + - CVE-2022-32154 + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1203/search_activity.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.16.0 + replacement_content: [] diff --git a/removed/detections/open_redirect_in_splunk_web.yml b/removed/detections/open_redirect_in_splunk_web.yml new file mode 100644 index 0000000000..5090cfd2cd --- /dev/null +++ b/removed/detections/open_redirect_in_splunk_web.yml @@ -0,0 +1,36 @@ +name: Open Redirect in Splunk Web +id: d199fb99-2312-451a-9daa-e5efa6ed76a7 +version: 3 +creation_date: '2019-10-16' +modification_date: '2026-05-14' +author: Bhavin Patel, Splunk +status: removed +type: TTP +description: This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability. +data_source: [] +search: index=_internal sourcetype=splunk_web_access return_to="/%09/*" | `open_redirect_in_splunk_web_filter` +how_to_implement: No extra steps needed to implement this search. +known_false_positives: None identified +references: [] +rba: + message: Exploitation of CVE-2016-4859 + risk_objects: + - field: uri + type: other + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + cve: + - CVE-2016-4859 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.2.0 + replacement_content: [] diff --git a/removed/detections/path_traversal_spl_injection.yml b/removed/detections/path_traversal_spl_injection.yml new file mode 100644 index 0000000000..83f3c7e25a --- /dev/null +++ b/removed/detections/path_traversal_spl_injection.yml @@ -0,0 +1,57 @@ +name: Path traversal SPL injection +id: dfe55688-82ed-4d24-a21b-ed8f0e0fda99 +version: 8 +creation_date: '2022-04-29' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +status: removed +type: TTP +description: The following analytic identifies attempts at path traversal in search parameters, which can lead to SPL injection. It detects this activity by searching for specific patterns in the `_internal` index that indicate path traversal attempts (e.g., "../../../../"). This activity is significant for a SOC because it can allow an attacker to manipulate the application to load data from incorrect endpoints, potentially running arbitrary SPL queries. If confirmed malicious, this could lead to unauthorized data access, code execution, or further exploitation of the Splunk environment. +data_source: + - Splunk +search: '`path_traversal_spl_injection` | search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by host status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests. +known_false_positives: This search may find additional path traversal exploitation attempts. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Path traversal exploitation attempt from $clientip$ + risk_objects: + - field: host + type: system + score: 40 + threat_objects: + - field: clientip + type: ip_address +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-26889 + mitre_attack_id: + - T1083 + product: + - Splunk Enterprise + - Splunk Enterprise Security + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.log + source: splunkd_ui_access.log + sourcetype: splunkd_ui_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/persistent_xss_in_rapiddiag_through_user_interface_views.yml b/removed/detections/persistent_xss_in_rapiddiag_through_user_interface_views.yml new file mode 100644 index 0000000000..5158d83a04 --- /dev/null +++ b/removed/detections/persistent_xss_in_rapiddiag_through_user_interface_views.yml @@ -0,0 +1,56 @@ +name: Persistent XSS in RapidDiag through User Interface Views +id: ce6e1268-e01c-4df2-a617-0f034ed49a43 +version: 6 +creation_date: '2023-02-14' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +type: TTP +status: removed +data_source: + - Splunk +description: The following analytic identifies potential persistent Cross-Site Scripting (XSS) attacks in Splunk Enterprise 9.0 versions before 9.0.4 through user interface views. It leverages audit logs from the `audit_searches` data source to detect actions involving Base64-encoded images in error messages. This activity is significant because it can allow attackers to inject malicious scripts that execute in the context of other users, leading to unauthorized actions or data exposure. If confirmed malicious, this could result in persistent control over the affected Splunk instance, compromising its integrity and confidentiality. +search: '`audit_searches` path=/opt/splunk/etc/users/*/search/local/data/ui/views/* action=* |table user action roles info roles path | dedup user action | `persistent_xss_in_rapiddiag_through_user_interface_views_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index +known_false_positives: This is a hunting search, it will not deobfuscate base64 payload, it provides however it will provide what user added the view artifact and what user opened it. It will require further investigation based on the information presented by this hunting search. +references: + - https://www.splunk.com/en_us/product-security.html +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A potential XSS attempt has been detected from $user$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-22932 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_absolute_path_traversal_using_runshellscript.yml b/removed/detections/splunk_absolute_path_traversal_using_runshellscript.yml new file mode 100644 index 0000000000..e4eec6a367 --- /dev/null +++ b/removed/detections/splunk_absolute_path_traversal_using_runshellscript.yml @@ -0,0 +1,54 @@ +name: Splunk Absolute Path Traversal Using runshellscript +id: 356bd3fe-f59b-4f64-baa1-51495411b7ad +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic detects the exploitation of an absolute path traversal vulnerability in Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, where an attacker can execute arbitrary code located on a separate disk. It leverages logs from the `splunk_python` macro, specifically looking for the `runshellscript` command with a specific argument count and path pattern. This activity is significant as it indicates a potential exploitation attempt that could lead to unauthorized code execution. If confirmed malicious, this could allow an attacker to gain control over the Splunk instance, leading to data breaches or further system compromise. +search: >- + `splunk_python` *runshellscript* | eval log_split=split(_raw, "runshellscript: + ") + | eval array_raw = mvindex(log_split,1) + | eval data_cleaned=replace(replace(replace(array_raw,"\[",""),"\]",""),"'","") + | eval array_indices=split(data_cleaned,",") + | eval runshellscript_args_count=mvcount(array_indices) + | where runshellscript_args_count = 10 + | eval interpreter=mvindex(array_indices,0) + | eval targetScript=mvindex(array_indices,1) + | eval targetScript != "*C:*" + | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter + targetScript + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `splunk_absolute_path_traversal_using_runshellscript_filter` +how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions. +known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0806 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1083 + cve: + - CVE-2023-40597 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_absolute_path_traversal_using_runshellscript_splunk_python.log + source: python.log + sourcetype: splunk_python + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_account_discovery_drilldown_dashboard_disclosure.yml b/removed/detections/splunk_account_discovery_drilldown_dashboard_disclosure.yml new file mode 100644 index 0000000000..2eaefa5733 --- /dev/null +++ b/removed/detections/splunk_account_discovery_drilldown_dashboard_disclosure.yml @@ -0,0 +1,39 @@ +name: Splunk Account Discovery Drilldown Dashboard Disclosure +id: f844c3f6-fd99-43a2-ba24-93e35fe84be6 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Marissa Bower, Rod Soto, Splunk +status: removed +type: TTP +description: The following analytic identifies the presence of environment variables in Splunk dashboard drilldown URLs. It uses the REST API to query dashboards for specific patterns in the XML data. This activity is significant because it can expose sensitive tokens from privileged users if an attacker shares a malicious dashboard. If confirmed malicious, this could allow an attacker to detokenize variables and potentially gain unauthorized access to sensitive information or escalate privileges within the Splunk environment. +data_source: [] +search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions App "Dashboard XML" | `splunk_account_discovery_drilldown_dashboard_disclosure_filter`' +how_to_implement: This search uses REST function to query for dashboards with environment variables present in URL options. +known_false_positives: This search may reveal non malicious URLs with environment variables used in organizations. +references: + - https://www.splunk.com/en_us/product-security.html +rba: + message: Potential exposure of environment variables from url embedded in dashboard + risk_objects: + - field: author + type: user + score: 40 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-37438 + mitre_attack_id: + - T1087 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_command_and_scripting_interpreter_delete_usage.yml b/removed/detections/splunk_command_and_scripting_interpreter_delete_usage.yml new file mode 100644 index 0000000000..c9b018cb5b --- /dev/null +++ b/removed/detections/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -0,0 +1,56 @@ +name: Splunk Command and Scripting Interpreter Delete Usage +id: 8d3d5d5e-ca43-42be-aa1f-bc64375f6b04 +version: 6 +creation_date: '2022-05-27' +modification_date: '2026-05-14' +author: Michael Haag, Splunk +status: removed +type: Anomaly +description: The following analytic detects the use of the 'delete' command in Splunk, which can be used to remove queried data. This detection leverages the Splunk Audit data model, specifically monitoring ad-hoc searches containing the 'delete' command by non-system users. This activity is significant because the 'delete' command is rarely used and can indicate potential data tampering or unauthorized data removal. If confirmed malicious, this activity could lead to the loss of critical log data, hindering incident investigations and compromising the integrity of the monitoring environment. +data_source: + - Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`' +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. +known_false_positives: False positives may be present if this command is used as a common practice. Filter as needed. +references: + - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: $user$ executed the 'delete' command, if this is unexpected it should be reviewed. + risk_objects: + - field: user + type: user + score: 27 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cve: + - CVE-2022-32154 + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.16.0 + replacement_content: [] diff --git a/removed/detections/splunk_command_and_scripting_interpreter_risky_commands.yml b/removed/detections/splunk_command_and_scripting_interpreter_risky_commands.yml new file mode 100644 index 0000000000..7a626b4904 --- /dev/null +++ b/removed/detections/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -0,0 +1,43 @@ +name: Splunk Command and Scripting Interpreter Risky Commands +id: 1cf58ae1-9177-40b8-a26c-8966040f11ae +version: 6 +creation_date: '2022-05-26' +modification_date: '2026-05-14' +author: Michael Haag, Splunk +status: removed +type: Hunting +description: The following analytic identifies the execution of risky commands within the Splunk platform, such as `runshellscript`, `delete`, and `sendemail`. It leverages the Search_Activity data model to detect ad hoc searches containing these commands, excluding those run by the splunk-system-user. This activity is significant because it may indicate attempts at data exfiltration, deletion, or other unauthorized actions by a malicious user. If confirmed malicious, this could lead to data loss, unauthorized data transfer, or system compromise, severely impacting the organization's security posture. +data_source: + - Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: False positives will be present until properly filtered by Username and search name. +references: + - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json + - https://advisory.splunk.com/advisories/SVD-2024-0302 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cve: + - CVE-2022-32154 + - CVE-2024-29946 + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as these commands are regular splunk commands and not recommended to be run as a detection search. + removed_in_version: 5.12.0 + replacement_content: [] diff --git a/removed/detections/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/removed/detections/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml new file mode 100644 index 0000000000..7a459413c9 --- /dev/null +++ b/removed/detections/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -0,0 +1,57 @@ +name: Splunk Command and Scripting Interpreter Risky SPL MLTK +id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca +version: 6 +creation_date: '2022-06-13' +modification_date: '2026-05-14' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +status: removed +type: Anomaly +description: The following analytic identifies the execution of risky SPL commands with abnormally long run times by leveraging a machine learning model named "risky_command_abuse." It uses the Splunk Audit data model to compare current search activities against a baseline of the past seven days. This activity is significant for a SOC as it can indicate potential misuse or abuse of powerful SPL commands, which could lead to unauthorized data access or system manipulation. If confirmed malicious, this activity could allow an attacker to execute arbitrary scripts, delete data, or exfiltrate sensitive information. +data_source: + - Splunk +search: '| tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse | fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`' +how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands. +known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. +references: + - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Abnormally long run time for risk SPL command seen by user- [$Search_Activity.user$] + risk_objects: + - field: user + type: user + score: 20 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cve: + - CVE-2022-32154 + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit + manual_test: This search has a baseline and timestamps hard coded into the search. +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1203/search_activity.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as these commands are regular splunk commands and not recommended to be run as a detection search. + removed_in_version: 5.12.0 + replacement_content: [] diff --git a/removed/detections/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml b/removed/detections/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml new file mode 100644 index 0000000000..73736b4f9c --- /dev/null +++ b/removed/detections/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml @@ -0,0 +1,56 @@ +name: Splunk CSRF in the SSG kvstore Client Endpoint +id: 4742d5f7-ce00-45ce-9c79-5e98b43b4410 +version: 7 +creation_date: '2023-02-14' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: TTP +description: The following analytic identifies attempts to exploit a cross-site request forgery (CSRF) vulnerability in the Splunk Secure Gateway (SSG) app's kvstore_client endpoint. It detects GET requests to the vulnerable endpoint using internal index data, focusing on specific URI paths and HTTP methods. This activity is significant because it can allow unauthorized updates to SSG KV store collections, potentially leading to data manipulation or unauthorized access. If confirmed malicious, this could enable attackers to alter critical configurations or exfiltrate sensitive information, compromising the integrity and security of the Splunk environment. +data_source: + - Splunk +search: '`splunkda` uri_path="/*/splunkd/__raw/services/ssg/kvstore_client" method="GET" delete_field_value="spacebridge_server" status="200" | table splunk_server status uri delete_field_value method post_data | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`' +how_to_implement: Requires access to internal index. +known_false_positives: This hunting search only applies to the affected versions and setup mentioned in the description of this search, it does not extract payload so it requires manual investigation after executing search. This search will produce false positives. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0212 +drilldown_searches: + - name: View the detection results for $splunk_server$ + search: '%original_detection_search% | search splunk_server = $splunk_server$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $splunk_server$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($splunk_server$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential CSRF exploitation attempt from $splunk_server$ + risk_objects: + - field: splunk_server + type: system + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-22942 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log + source: splunkd_access.log + sourcetype: splunkd_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml b/removed/detections/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml new file mode 100644 index 0000000000..972b14773a --- /dev/null +++ b/removed/detections/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml @@ -0,0 +1,40 @@ +name: Splunk Data exfiltration from Analytics Workspace using sid query +id: b6d77c6c-f011-4b03-8650-8f10edb7c4a8 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis +status: removed +type: Hunting +description: The following analytic identifies attempts to exfiltrate data by executing a prepositioned malicious search ID in Splunk's Analytic Workspace. It leverages the `audit_searches` data source to detect suspicious `mstats` commands indicative of injection attempts. This activity is significant as it may indicate a phishing-based attack where an attacker compels a victim to initiate a malicious request, potentially leading to unauthorized data access. If confirmed malicious, this could result in significant data exfiltration, compromising sensitive information and impacting the organization's security posture. +data_source: + - Splunk +search: '`audit_searches` info=granted search NOT ("audit_searches") search NOT ("security_content_summariesonly") AND ((search="*mstats*[*]*" AND provenance="N/A") OR (search="*mstats*\\\"*[*]*\\\"*"))| eval warning=if(match(search,"\\\\\""), "POTENTIAL INJECTION STAGING", "POTENTIAL INJECTION EXECUTION") | table search, user, warning, timestamp | `splunk_data_exfiltration_from_analytics_workspace_using_sid_query_filter`' +how_to_implement: The vulnerability affects only instances with Splunk Web Enabled. After running this search, please run "Splunk Command and Scripting Interpreter Risky SPL MLTK" to gain more insight into potentially risky commands which could lead to data exfiltration. +known_false_positives: This search may produce false positives. This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. Special attention must be paid to "/en-US/app/search/analytics_workspace?sid=[sid]" which is where the malicious code will be inserted to trigger attack at victim. +references: + - https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-43566 + mitre_attack_id: + - T1567 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/splunk/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_digital_certificates_infrastructure_version.yml b/removed/detections/splunk_digital_certificates_infrastructure_version.yml new file mode 100644 index 0000000000..8d552bc437 --- /dev/null +++ b/removed/detections/splunk_digital_certificates_infrastructure_version.yml @@ -0,0 +1,42 @@ +name: Splunk Digital Certificates Infrastructure Version +id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: Hunting +description: The following analytic identifies improper TLS validation configuration on Splunk search heads and peers post version 9. It leverages REST API calls to retrieve server information and SSL configuration settings, checking fields like `sslVerifyServerCert` and `sslVerifyServerName`. This activity is significant for a SOC as improper TLS settings can expose the infrastructure to man-in-the-middle attacks and data breaches. If confirmed malicious, attackers could intercept or manipulate data, compromising the integrity and confidentiality of communications within the Splunk environment. +data_source: + - Splunk +search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: No known at this time. +references: + - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32153 + mitre_attack_id: + - T1587.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_digital_certificates_lack_of_encryption.yml b/removed/detections/splunk_digital_certificates_lack_of_encryption.yml new file mode 100644 index 0000000000..9719bf83c0 --- /dev/null +++ b/removed/detections/splunk_digital_certificates_lack_of_encryption.yml @@ -0,0 +1,58 @@ +name: Splunk Digital Certificates Lack of Encryption +id: 386a7ebc-737b-48cf-9ca8-5405459ed508 +version: 6 +creation_date: '2022-05-26' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: Anomaly +description: The following analytic identifies Splunk forwarder connections that are not using TLS encryption. It leverages data from the `splunkd` logs, specifically looking for connections where the `ssl` field is set to "false". This activity is significant because unencrypted connections can expose sensitive data and allow unauthorized access, posing a security risk. If confirmed malicious, an attacker could exploit this vulnerability to download or publish forwarder bundles, potentially leading to arbitrary code execution and further compromise of the environment. +data_source: + - Splunk +search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' +how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: None at this time +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +drilldown_searches: + - name: View the detection results for $hostname$ + search: '%original_detection_search% | search hostname = $hostname$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $hostname$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($hostname$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: $hostname$ is not using TLS when forwarding data + risk_objects: + - field: hostname + type: system + score: 20 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32151 + mitre_attack_id: + - T1587.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log + source: /opt/splunk/var/log/splunk/metrics.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_disable_kvstore_via_csrf_enabling_maintenance_mode.yml b/removed/detections/splunk_disable_kvstore_via_csrf_enabling_maintenance_mode.yml new file mode 100644 index 0000000000..e13cca3455 --- /dev/null +++ b/removed/detections/splunk_disable_kvstore_via_csrf_enabling_maintenance_mode.yml @@ -0,0 +1,56 @@ +name: Splunk Disable KVStore via CSRF Enabling Maintenance Mode +id: 34bac267-a89b-4bd7-a072-a48eef1f15b8 +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +data_source: + - Splunk +type: TTP +status: removed +description: "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, 9.1.2312.204, and 9.1.2308.211, a low-privileged user that does not hold the “admin” or “power” Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF)." +search: '`splunkda` method=GET uri_path IN ("/services*", /"servicesNS*") AND uri_path = "*kvstore/maintenance/change" AND uri_query IN ("*mode=t*", "*mode=1*") | stats count min(_time) as firstTime max(_time) as lastTime by user host uri clientip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_disable_kvstore_via_csrf_enabling_maintenance_mode_filter`' +how_to_implement: Requires access to internal indexes and web service enabled. +known_false_positives: This search will produce false positives, operator must verify the context of access and the use of GET request against KVStore specifiying maintenance mode, especially non admin users. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1007 +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential CSRF attack against $user$ and $host$ by placing KVStore into Maintenance Mode + risk_objects: + - field: host + type: system + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45737 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/splunk_kvstore_csrf/splunk_kvstore_csrf.log + custom_index: _internal + sourcetype: splunkd_access + source: /opt/splunk/var/log/splunk/splunkd_access.log +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_dos_using_malformed_saml_request.yml b/removed/detections/splunk_dos_using_malformed_saml_request.yml new file mode 100644 index 0000000000..620b7e9742 --- /dev/null +++ b/removed/detections/splunk_dos_using_malformed_saml_request.yml @@ -0,0 +1,38 @@ +name: Splunk DoS Using Malformed SAML Request +id: 8e8a86d5-f323-4567-95be-8e817e2baee6 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic detects a denial of service (DoS) attempt using a malformed SAML request targeting the /saml/acs REST endpoint in Splunk Enterprise versions lower than 9.0.6 and 8.2.12. It leverages `splunkd` logs, specifically looking for error messages containing "xpointer" in the `expr` field. This activity is significant because it can cause the Splunk daemon to crash or hang, disrupting service availability. If confirmed malicious, this attack could lead to prolonged downtime, impacting the organization's ability to monitor and respond to security events. +search: '`splunkd` event_message=*error* expr=*xpointer* | stats count min(_time) as firstTime max(_time) as lastTime by component expr splunk_server event_message | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_dos_using_malformed_saml_request_filter`' +how_to_implement: To run this search, you must have access to the _internal index. +known_false_positives: This search will show false positives. The analyst must look for errors and a pointer indicating a malicious file. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0802 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1498 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk/splunk_dos_using_malformed_saml_request_splunkd.log + source: splunkd.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_dos_via_dump_spl_command.yml b/removed/detections/splunk_dos_via_dump_spl_command.yml new file mode 100644 index 0000000000..3023067e91 --- /dev/null +++ b/removed/detections/splunk_dos_via_dump_spl_command.yml @@ -0,0 +1,37 @@ +name: Splunk DOS Via Dump SPL Command +id: fb0e6823-365f-48ed-b09e-272ac4c1dad6 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies a potential Denial of Service (DoS) attack exploiting the dump SPL command in vulnerable Splunk Enterprise versions. It detects this activity by searching the `splunk_crash_log` for segmentation fault entries, indicating a crash of the Splunk daemon. This activity is significant for a SOC because it can disrupt the availability of Splunk services, impacting monitoring and incident response capabilities. If confirmed malicious, this attack could render Splunk Enterprise unusable, severely hindering an organization's ability to detect and respond to other security threats. +search: '`splunk_crash_log` "*Segmentation fault*" | stats count by host _time | `splunk_dos_via_dump_spl_command_filter`' +how_to_implement: This search does not require additional ingestion of data. Requires the ability to search _internal index and monitor segmentation faults. +known_false_positives: Segmentation faults may occur due to other causes, so this search may produce false positives +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + atomic_guid: [] + mitre_attack_id: + - T1499.004 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_dos_via_dump_spl_command.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd_crash_log + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_dos_via_malformed_s2s_request.yml b/removed/detections/splunk_dos_via_malformed_s2s_request.yml new file mode 100644 index 0000000000..b8204f77e2 --- /dev/null +++ b/removed/detections/splunk_dos_via_malformed_s2s_request.yml @@ -0,0 +1,58 @@ +name: Splunk DoS via Malformed S2S Request +id: fc246e56-953b-40c1-8634-868f9e474cbd +version: 7 +creation_date: '2022-03-24' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: TTP +description: The following analytic identifies attempts to exploit a Denial of Service (DoS) vulnerability in the Splunk-to-Splunk (S2S) protocol by detecting malformed S2S requests. It leverages `splunkd` logs, specifically looking for "ERROR" level logs from the "TcpInputProc" component with the thread name "FwdDataReceiverThread" and the message "Invalid _meta atom." This activity is significant as it targets a known vulnerability that could disrupt Splunk services. If confirmed malicious, this could lead to service outages, impacting the availability and reliability of Splunk for monitoring and analysis. +data_source: + - Splunk +search: '`splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will only find attempted exploitation on versions of Splunk already patched for CVE-2021-3422. +known_false_positives: None. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$ + risk_objects: + - field: host + type: system + score: 50 + threat_objects: + - field: src + type: ip_address +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2021-3422 + mitre_attack_id: + - T1498 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_dos_via_post_request_datamodel_endpoint.yml b/removed/detections/splunk_dos_via_post_request_datamodel_endpoint.yml new file mode 100644 index 0000000000..52bed0d4da --- /dev/null +++ b/removed/detections/splunk_dos_via_post_request_datamodel_endpoint.yml @@ -0,0 +1,40 @@ +name: Splunk DoS via POST Request Datamodel Endpoint +id: 45766810-dbb2-44d4-b889-b4ba3ee0d1f5 +version: 5 +creation_date: '2024-07-01' +modification_date: '2026-05-14' +status: removed +author: Rod Soto +type: Hunting +data_source: [] +description: The following is a hunting search that allows investigation of error messages indicating Splunk HTTP engine shutdown as a result of a crafted posted request against '/datamodel/model' endpoint. +search: >- + `splunkd_webs` log_level=INFO message="ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('127.0.0.1', 8065)) shut down" | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server message | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_dos_via_post_request_datamodel_endpoint_filter` +how_to_implement: Need access to the internal indexes. +known_false_positives: This is a hunting search and will produce false positives as other causes can also shut down splunk HTTP engine, however this denial of service error is associated to a request to the datamodel/model endpoing which operator can research and find proximity of request and message in logs. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0710 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise + security_domain: endpoint + cve: + - CVE-2024-36986 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0710_web_service_splunk_web_service.log + source: /opt/splunk/var/log/splunk/web_service.log + sourcetype: splunk_web_service + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_dos_via_printf_search_function.yml b/removed/detections/splunk_dos_via_printf_search_function.yml new file mode 100644 index 0000000000..7fa3779aae --- /dev/null +++ b/removed/detections/splunk_dos_via_printf_search_function.yml @@ -0,0 +1,40 @@ +name: Splunk DOS via printf search function +id: 78b48d08-075c-4eac-bd07-e364c3780867 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Splunk +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies the use of the `printf` SPL function in Splunk searches, which can be exploited for a denial of service (DoS) attack. It detects this activity by querying the `audit_searches` data source for specific patterns involving `makeresults`, `eval`, `fieldformat`, and `printf` functions, excluding searches by the `splunk_system_user`. This activity is significant because it targets a known vulnerability in Splunk Enterprise versions lower than 8.1.14, 8.2.12, 9.0.6, and 9.1.1, potentially disrupting the availability of the Splunk instance. If confirmed malicious, this could lead to service outages and impact the monitoring and logging capabilities of the organization. +search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search!="*audit_searches*" | stats count by user splunk_server host search | convert ctime(*time) |`splunk_dos_via_printf_search_function_filter`' +how_to_implement: This search requires the ability to search internal indexes. +known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-40594 + mitre_attack_id: + - T1499.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_edit_user_privilege_escalation.yml b/removed/detections/splunk_edit_user_privilege_escalation.yml new file mode 100644 index 0000000000..a561b5d703 --- /dev/null +++ b/removed/detections/splunk_edit_user_privilege_escalation.yml @@ -0,0 +1,40 @@ +name: Splunk Edit User Privilege Escalation +id: 39e1c326-67d7-4c0d-8584-8056354f6593 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies attempts by low-privilege users to escalate their privileges to admin by exploiting the edit_user capability. It detects this activity by analyzing audit trail logs for specific actions such as "change_own_password" and "edit_password" where the info field is "granted" and the user is not an admin or system user. This activity is significant because it indicates potential privilege escalation, which is a critical security concern. If confirmed malicious, this could allow an attacker to gain administrative access, leading to full control over the Splunk environment and potential data breaches. +search: '`audittrail` action IN ("change_own_password","password_change","edit_password") AND info="granted" AND NOT user IN (admin, splunk-system-user) | stats earliest(_time) as event_time values(index) as index values(sourcetype) as sourcetype values(action) as action values(info) as info by user | `splunk_edit_user_privilege_escalation_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover abuse of edit_user privilege. +known_false_positives: This search may produce false positives as password changing actions may be part of normal behavior. Operator will need to investigate these actions in order to discern exploitation attempts. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-32707 + mitre_attack_id: + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_edit_user_privilege_escalation.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_endpoint_denial_of_service_dos_zip_bomb.yml b/removed/detections/splunk_endpoint_denial_of_service_dos_zip_bomb.yml new file mode 100644 index 0000000000..65513a5320 --- /dev/null +++ b/removed/detections/splunk_endpoint_denial_of_service_dos_zip_bomb.yml @@ -0,0 +1,57 @@ +name: Splunk Endpoint Denial of Service DoS Zip Bomb +id: b237d393-2f57-4531-aad7-ad3c17c8b041 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Marissa Bower, Rod Soto, Splunk +status: removed +type: TTP +description: The following analytic identifies crashes in the Splunk search app caused by specially crafted ZIP files, affecting Universal Forwarder versions 8.1.11 and 8.2 versions below 8.2.7.1. It detects this activity by monitoring Universal Forwarder error logs for specific messages indicating invalid or binary file issues. This activity is significant because it can disrupt Splunk operations, leading to potential data loss or monitoring gaps. If confirmed malicious, this attack could result in a denial of service, hindering the organization's ability to monitor and respond to other security incidents effectively. +data_source: + - Splunk +search: '`splunkd` component=FileClassifierManager event_message=*invalid* event_message=*binary* |stats count by host component event_message | `splunk_endpoint_denial_of_service_dos_zip_bomb_filter`' +how_to_implement: Need to monitor Splunkd data from Universal Forwarders. +known_false_positives: This search may reveal non malicious zip files causing errors as well. +references: + - https://en.wikipedia.org/wiki/ZIP_(file_format) + - https://www.splunk.com/en_us/product-security.html +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential exposure of environment variables from url embedded in dashboard + risk_objects: + - field: host + type: system + score: 75 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-37439 + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_zip_bomb_vulnerability.log + source: /opt/splunkforwarder/var/log/splunk/splunkd.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_enterprise_information_disclosure.yml b/removed/detections/splunk_enterprise_information_disclosure.yml new file mode 100644 index 0000000000..f47643d1d9 --- /dev/null +++ b/removed/detections/splunk_enterprise_information_disclosure.yml @@ -0,0 +1,36 @@ +name: Splunk Enterprise Information Disclosure +id: f6a26b7b-7e80-4963-a9a8-d836e7534ebd +version: 3 +creation_date: '2020-04-29' +modification_date: '2026-05-14' +author: David Dorsey, Splunk +status: removed +type: TTP +description: This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug. +data_source: [] +search: index=_internal sourcetype=splunkd_ui_access server-info | search clientip!=127.0.0.1 uri_path="*raw/services/server/info/server-info" | rename clientip as src_ip, splunk_server as dest | stats earliest(_time) as firstTime, latest(_time) as lastTime, values(uri) as uri, values(useragent) as http_user_agent, values(user) as user by src_ip, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_information_disclosure_filter` +how_to_implement: The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Whitelisting your Splunk systems will reduce false positives. +known_false_positives: Retrieving server information may be a legitimate API request. Verify that the attempt is a valid request for information. +references: [] +rba: + message: Potential Exploitation of CVE-2018-11409 + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + cve: + - CVE-2018-11409 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.2.0 + replacement_content: [] diff --git a/removed/detections/splunk_enterprise_windows_deserialization_file_partition.yml b/removed/detections/splunk_enterprise_windows_deserialization_file_partition.yml new file mode 100644 index 0000000000..f4b7643604 --- /dev/null +++ b/removed/detections/splunk_enterprise_windows_deserialization_file_partition.yml @@ -0,0 +1,54 @@ +name: Splunk Enterprise Windows Deserialization File Partition +id: 947d4d2e-1b64-41fc-b32a-736ddb88ce97 +version: 7 +creation_date: '2024-01-22' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Chase Franklin +status: removed +type: TTP +data_source: + - Splunk +description: The following analytic identifies attempts to exploit a deserialization vulnerability in Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3. It detects irregular path file executions by analyzing `splunk_python` logs and extracting file paths and names. This activity is significant because it indicates potential exploitation of a known vulnerability, which could lead to arbitrary code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, and potentially compromise the entire Splunk environment, leading to data breaches and further system exploitation. +search: '`splunk_python` request_path="/*/app/search/C:\\Program" *strings* | rex "request_path=(?[^\"]+)" | rex field=file_path "[^\"]+/(?[^\"\''\s/\\\\]+)" | stats min(_time) as firstTime max(_time) as lastTime values(file_path) as file_path values(file_name) as file_name by index, sourcetype, host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_windows_deserialization_file_partition_filter`' +how_to_implement: Requires access to internal indexes. This detection search will display irregular path file execution, which will display exploit attempts. Only applies to Microsoft Windows Splunk versions. +known_false_positives: Irregular path with files that may be purposely called for benign reasons may produce false positives. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0108 +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Possible Windows Deserialization exploitation via irregular path file against $host$ + risk_objects: + - field: host + type: system + score: 90 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1190 + cve: + - CVE-2024-23678 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_enterprise_windows_deserialization_file_partition_splunk_python.log + source: C:\Program File\Splunk\var\log\splunk\python.log + sourcetype: splunk_python + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_es_dos_investigations_manager_via_investigation_creation.yml b/removed/detections/splunk_es_dos_investigations_manager_via_investigation_creation.yml new file mode 100644 index 0000000000..b598b8ce56 --- /dev/null +++ b/removed/detections/splunk_es_dos_investigations_manager_via_investigation_creation.yml @@ -0,0 +1,57 @@ +name: Splunk ES DoS Investigations Manager via Investigation Creation +id: 7f6a07bd-82ef-46b8-8eba-802278abd00e +version: 6 +creation_date: '2024-01-10' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Chase Franklin +status: removed +type: TTP +data_source: + - Splunk +description: The following analytic detects the creation of malformed Investigations in Splunk Enterprise Security (ES) versions lower than 7.1.2, which can lead to a denial of service (DoS). It leverages internal Splunk logs, specifically monitoring the `splunkd_investigation_rest_handler` with error statuses during investigation creation. This activity is significant as it can disrupt the functionality of the Investigations manager, hindering incident response efforts. If confirmed malicious, this could prevent security teams from accessing critical investigation data, severely impacting their ability to manage and respond to security incidents effectively. +search: '`splunkd_investigation_rest_handler` method=put msg=*investigation* status=error | stats count min(_time) as firstTime max(_time) as lastTime by user host method msg | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_es_dos_investigations_manager_via_investigation_creation_filter`' +how_to_implement: This search requires access to internal indexes. Only affects Splunk Enterprise Security versions lower than 7.1.2. +known_false_positives: The vulnerability requires an authenticated session and access to create an Investigation. It only affects the availability of the Investigations manager, but without the manager, the Investigations functionality becomes unusable for most users. This search gives the exact offending event. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0102 +drilldown_searches: + - name: View the detection results for $user$ and $host$ + search: '%original_detection_search% | search user = $user$ host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ and $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$, $host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Denial of Service Attack against Splunk ES Investigation Manager by $user$ + risk_objects: + - field: host + type: system + score: 100 + - field: user + type: user + score: 100 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2024-22165 + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise Security + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_cve_2024_22165_investigation_rest_handler.log + source: /opt/splunk/var/log/splunk/investigation_handler.log + sourcetype: investigation_rest_handler + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_es_dos_through_investigation_attachments.yml b/removed/detections/splunk_es_dos_through_investigation_attachments.yml new file mode 100644 index 0000000000..4ada07dc58 --- /dev/null +++ b/removed/detections/splunk_es_dos_through_investigation_attachments.yml @@ -0,0 +1,54 @@ +name: Splunk ES DoS Through Investigation Attachments +id: bb85b25e-2d6b-4e39-bd27-50db42edcb8f +version: 6 +creation_date: '2024-01-10' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Chase Franklin +status: removed +type: TTP +data_source: + - Splunk +description: The following analytic detects attempts to perform a denial of service (DoS) attack through investigation attachments in Splunk Enterprise Security (ES) versions below 7.1.2. It leverages internal Splunk logs, specifically monitoring the `splunkd_investigation_rest_handler` for error statuses related to investigation objects. This activity is significant because it can render the Investigation feature inaccessible, disrupting incident response and forensic analysis. If confirmed malicious, this attack could prevent security teams from effectively managing and investigating security incidents, leading to prolonged exposure and potential data breaches. +search: '`splunkd_investigation_rest_handler` status=error object=investigation | stats min(_time) as firstTime max(_time) as lastTime values(status) as status values(msg) as msg values(id) as investigation_id by user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_es_dos_through_investigation_attachments_filter`' +how_to_implement: This search requires access to internal indexes, only affects Enterprise Security versions below 7.1.2. +known_false_positives: This search will show the exact DoS event via error message and investigation id. The error however does not point exactly at the uploader as any users associated with the investigation will be affected. Operator must investigate using investigation id the possible origin of the malicious upload. Attack only affects specific investigation not the investigation manager. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0101 +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Denial of Service detected at Splunk ES affecting $user$ + risk_objects: + - field: user + type: user + score: 100 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2024-22164 + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise Security + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_cve_2024_22164_investigation_rest_handler.log + source: /opt/splunk/var/log/splunk/investigation_handler.log + sourcetype: investigation_rest_handler + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_http_response_splitting_via_rest_spl_command.yml b/removed/detections/splunk_http_response_splitting_via_rest_spl_command.yml new file mode 100644 index 0000000000..ee9c84c4de --- /dev/null +++ b/removed/detections/splunk_http_response_splitting_via_rest_spl_command.yml @@ -0,0 +1,36 @@ +name: Splunk HTTP Response Splitting Via Rest SPL Command +id: e615a0e1-a1b2-4196-9865-8aa646e1708c +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies attempts to exploit an HTTP response splitting vulnerability via the rest SPL command in Splunk. It detects this activity by analyzing audit logs for specific search commands that include REST methods like POST, PUT, PATCH, or DELETE. This behavior is significant because it indicates a potential attempt to access restricted REST endpoints, which could lead to unauthorized access to sensitive information. If confirmed malicious, this activity could allow an attacker to access restricted content, such as password files, by injecting commands into HTTP requests. +search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="*audit_searches*" | table user info has_error_msg search _time | `splunk_http_response_splitting_via_rest_spl_command_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search may assist in detecting possible http response splitting exploitation attemptss. +known_false_positives: This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed willingly or erroneously by operators. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1027.006 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.006/splunk/splunk_http_response_splitting_via_rest_spl_command.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_identified_ssl_tls_certificates.yml b/removed/detections/splunk_identified_ssl_tls_certificates.yml new file mode 100644 index 0000000000..75ac839c96 --- /dev/null +++ b/removed/detections/splunk_identified_ssl_tls_certificates.yml @@ -0,0 +1,41 @@ +name: Splunk Identified SSL TLS Certificates +id: 620fbb89-86fd-4e2e-925f-738374277586 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Michael Haag, Splunk +status: removed +type: Hunting +description: The following analytic identifies the usage of Splunk default SSL/TLS certificates within the environment. It leverages tags such as SSL, TLS, and certificate to detect these default certificates by examining the ssl_issuer_common_name field. This activity is significant because using default certificates can expose the environment to potential security risks, as they are not unique and can be easily exploited. If confirmed malicious, attackers could intercept or manipulate data, leading to unauthorized access or data breaches. It is recommended to replace default certificates with valid, unique TLS certificates to enhance security. +data_source: + - Splunk Stream TCP +search: tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter` +how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: False positives will not be present as it is meant to assist with identifying default certificates being utilized. +references: + - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Proxy + cve: + - CVE-2022-32151 + - CVE-2022-32152 + mitre_attack_id: + - T1040 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log + source: stream:tcp + sourcetype: stream:tcp +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard.yml b/removed/detections/splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard.yml new file mode 100644 index 0000000000..9d9d26d173 --- /dev/null +++ b/removed/detections/splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard.yml @@ -0,0 +1,46 @@ +name: Splunk Image File Disclosure via PDF Export in Classic Dashboard +id: 7464e2dc-98a5-4af9-87a1-fa6d5a256fa6 +version: 5 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto +data_source: + - Splunk +type: Hunting +status: removed +description: In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could view images on the host machine using the PDF export feature in Splunk classic dashboards. +search: |- + ```Search for any PDFs that have been generated``` + index=_internal sourcetype=splunk_pdfgen "Generated pdf" + ```Extract a potential Dashboard Filename``` + | rex field=filename "(?.*)-[0-9]{4}-[0-9]{1,2}-[0-9]{1,2}.pdf" + ```Join this with all dashboards. Potentially vulnerable dashbaords MUST be classic (version 1.1) AND contain at least one <img...> tag``` + | join type=inner title + [| rest /servicesNS/-/-/data/ui/views + | search eai:data="*<img*" version="1.1"] + | stats count min(_time) as earliestTime max(_time) as latestTime by author eai:acl.app label title eai:data + | `security_content_ctime(earliestTime)` + | `security_content_ctime(latestTime)` + | `splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard_filter` +how_to_implement: Need to access to REST API. +known_false_positives: This is a hunting search and operator must identify indicators of local host image source such as UNC paths ('C:\'', '//'') in order to identify potential exploitation of this vulnerability. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1004 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1087 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45734 + manual_test: This search uses a REST call against a running Splunk instance to fetch information about dashboards. It cannot be replicated with a normal test or attack data. +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_improperly_formatted_parameter_crashes_splunkd.yml b/removed/detections/splunk_improperly_formatted_parameter_crashes_splunkd.yml new file mode 100644 index 0000000000..8ff89b8d03 --- /dev/null +++ b/removed/detections/splunk_improperly_formatted_parameter_crashes_splunkd.yml @@ -0,0 +1,50 @@ +name: Splunk Improperly Formatted Parameter Crashes splunkd +id: 08978eca-caff-44c1-84dc-53f17def4e14 +version: 8 +creation_date: '2023-02-14' +modification_date: '2026-05-14' +author: Chase Franklin, Rod Soto, Splunk +status: removed +type: TTP +description: The following analytic detects the execution of improperly formatted INGEST_EVAL parameters in Splunk Enterprise, which can crash the splunkd service. It leverages the Splunk_Audit.Search_Activity datamodel to identify ad-hoc searches containing specific keywords. This activity is significant because it can disrupt Splunk operations, leading to potential data loss and service downtime. If confirmed malicious, an attacker could exploit this to cause a denial of service, impacting the availability and reliability of the Splunk environment. +data_source: + - Splunk +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*"AND + Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc + Search_Activity.search!="*splunk_improperly_formatted_parameter_crashes_splunkd_filter*" + Search_Activity.user!=splunk-system-user by Search_Activity.search, Search_Activity.info, + Search_Activity.total_run_time, Search_Activity.user, Search_Activity.search_type + | `drop_dm_object_name(Search_Activity)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_improperly_formatted_parameter_crashes_splunkd_filter` +how_to_implement: Requires access to audittrail and use of Splunk_Audit.Search_Activity datamodel. +known_false_positives: This is a hunting search it should be focused on affected products, otherwise it is likely to produce false positives. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0211 + - https://advisory.splunk.com/advisories/SVD-2024-1006 +rba: + message: An attempt to exploit ingest eval parameter was detected from $user$ + risk_objects: + - field: user + type: user + score: 100 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + cve: + - CVE-2023-22941 + - CVE-2024-45736 + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise + security_domain: threat +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.16.0 + replacement_content: [] diff --git a/removed/detections/splunk_information_disclosure_in_splunk_add_on_builder.yml b/removed/detections/splunk_information_disclosure_in_splunk_add_on_builder.yml new file mode 100644 index 0000000000..d25779b505 --- /dev/null +++ b/removed/detections/splunk_information_disclosure_in_splunk_add_on_builder.yml @@ -0,0 +1,30 @@ +name: Splunk Information Disclosure in Splunk Add-on Builder +id: b7b82980-4a3e-412e-8661-4531d8758735 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies the presence of vulnerable versions of Splunk Add-on Builder (below 4.1.4) that write sensitive information to internal log files. It uses REST API queries to check installed app versions and flags those below the secure threshold. This activity is significant because it exposes sensitive data, which could be exploited by attackers. If confirmed malicious, this vulnerability could lead to unauthorized access to sensitive information, compromising the security and integrity of the Splunk environment. Immediate updates to version 4.1.4 or higher are recommended. +search: '| rest /services/apps/local | search disabled=0 core=0 label="Splunk Add-on Builder" | dedup label | search version < 4.1.4 | eval WarningMessage="Splunk Add-on Builder Versions older than v4.1.4 contain a critical vulnerability. Update to Splunk Add-on Builder v4.1.4 or higher immediately. For more information about this vulnerability, please refer to https://advisory.splunk.com/advisories/SVD-2024-0111" | table label version WarningMessage | `splunk_information_disclosure_in_splunk_add_on_builder_filter`' +how_to_implement: This search should be run on search heads where Splunk Add-on Builder may be installed. The results of this search will conclusively show whether or not a vulnerable version of Splunk Add-on Builder is currently installed. +known_false_positives: This search is highly specific for vulnerable versions of Splunk Add-on Builder. There are no known false positives. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0111 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1082 + product: + - Splunk Enterprise + security_domain: endpoint + manual_test: This search uses a REST call against a running Splunk instance to fetch the versions of installed apps. It cannot be replicated with a normal test or attack data. +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_list_all_nonstandard_admin_accounts.yml b/removed/detections/splunk_list_all_nonstandard_admin_accounts.yml new file mode 100644 index 0000000000..e42794227f --- /dev/null +++ b/removed/detections/splunk_list_all_nonstandard_admin_accounts.yml @@ -0,0 +1,33 @@ +name: Splunk list all nonstandard admin accounts +id: 401d689c-8596-4c6b-a710-7b6fdca296d3 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +description: 'The following analytic identifies nonstandard Splunk accounts with administrative rights on the instance, excluding the default admin account. It uses REST API calls to retrieve user data and filters for accounts with admin capabilities. This activity is significant as unauthorized admin accounts can indicate potential security breaches or misconfigurations. If confirmed malicious, attackers could leverage these accounts to execute commands, escalate privileges, or persist within the environment, posing a significant risk to the integrity and security of the Splunk instance.' +data_source: + - Splunk +search: '| rest splunk_server=local /services/authentication/users |search capabilities=admin* OR imported_capabilities=admin* title!=admin | table title roles capabilities splunk_server | `splunk_list_all_nonstandard_admin_accounts_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. If there have been admin account, in addition to the standard admin account, intentionally created on this server, then edit the filter macro to exclude them. +known_false_positives: It is not possible to discern from the user table whether or not users with admin rights have been created intentionally, accidentally, or as a result of exploitation. Each user with these rights should be investigated and, if legitimate, added to the filter macro above. If a user is not believed to be legitimate, then further investigation should take place. +references: + - https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-22933 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_low_priv_search_as_nobody_splunkdeploymentserverconfig_app.yml b/removed/detections/splunk_low_priv_search_as_nobody_splunkdeploymentserverconfig_app.yml new file mode 100644 index 0000000000..6fe94ccfc7 --- /dev/null +++ b/removed/detections/splunk_low_priv_search_as_nobody_splunkdeploymentserverconfig_app.yml @@ -0,0 +1,37 @@ +name: Splunk Low-Priv Search as nobody SplunkDeploymentServerConfig App +id: f765c3fe-c3b6-4afe-a932-11dd4f3a024f +version: 5 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto, Deivid Aguero +data_source: + - Splunk +type: Hunting +status: removed +description: In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the “admin” or “power” Splunk roles could run a search as ”nobody” in the SplunkDeploymentServerConfig app allowing access to potentially restricted data. +search: |- + | rest services/apps/local/SplunkDeploymentServerConfig + | table label, splunk_server, eai:acl.perms.read, eai:acl.perms.write, eai:acl.can_change_perms + | `splunk_low_priv_search_as_nobody_splunkdeploymentserverconfig_app_filter` +how_to_implement: Requires access to REST Api. +known_false_positives: This search displays effective permissions for SplunkDeploymentServerConfig. If permissions are inadequate they must be fixed. Please refer to the SVD-2024-1002 for more information about these permissions. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1002 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1068 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45732 + manual_test: This search uses a REST call against a running Splunk instance to fetch information about an Splunk App. It cannot be replicated with a normal test or attack data. +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_low_privilege_user_can_view_hashed_splunk_password.yml b/removed/detections/splunk_low_privilege_user_can_view_hashed_splunk_password.yml new file mode 100644 index 0000000000..cdc685c5ef --- /dev/null +++ b/removed/detections/splunk_low_privilege_user_can_view_hashed_splunk_password.yml @@ -0,0 +1,36 @@ +name: Splunk Low Privilege User Can View Hashed Splunk Password +id: a1be424d-e59c-4583-b6f9-2dcc23be4875 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies low-privilege users attempting to view hashed Splunk passwords by querying the conf-user-seed REST endpoint. It leverages data from the `splunkd_web` logs, specifically monitoring access to the conf-user-seed endpoint. This activity is significant because it can indicate an attempt to escalate privileges by obtaining hashed credentials, potentially leading to admin account takeover. If confirmed malicious, this could allow an attacker to gain administrative control over the Splunk instance, compromising the entire environment's security. +search: '`splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*" | stats earliest(_time) as event_time values(method) as method values(status) as status values(clientip) as clientip values(useragent) as useragent values(file) as file by user | convert ctime(*time) | `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover attempts to access con-user-seed file content. +known_false_positives: This search may produce false positives as accounts with high privileges may access this file. Operator will need to investigate these actions in order to discern exploitation attempts. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1212 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/splunk/splunk_low_privilege_user_can_view_hashed_splunk_password.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_persistent_xss_via_props_conf.yml b/removed/detections/splunk_persistent_xss_via_props_conf.yml new file mode 100644 index 0000000000..f4106232aa --- /dev/null +++ b/removed/detections/splunk_persistent_xss_via_props_conf.yml @@ -0,0 +1,45 @@ +name: 'Splunk Persistent XSS via Props Conf' +id: d7b5aa71-157f-4359-9c34-e35752b1d0a2 +version: 5 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto +data_source: + - Splunk +type: Hunting +status: removed +description: In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the “admin” or “power” Splunk roles could craft a malicious payload through entity.details in props.conf that could result in execution of unauthorized JavaScript code in the browser of a user. +search: |- + `splunkd_ui` status=201 uri_path="*/splunkd/__raw/servicesNS/*/*/configs/*" + | stats count min(_time) as firstTime max(_time) as lastTime by host clientip user uri status + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_persistent_xss_via_props_conf_filter` +how_to_implement: Requires access to internal index and web component enabled. +known_false_positives: This is a hunting search that provides information on the creation of a scheduled view against the targeted endpoint("*/splunkd/__raw/servicesNS/user/search/configs/*"). In the attack flow the payload is saved via scheduled view then sent to the victim. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1011 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45741 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/svd-2024-1011.log + sourcetype: splunkd_ui_access + custom_index: _internal + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_persistent_xss_via_scheduled_views.yml b/removed/detections/splunk_persistent_xss_via_scheduled_views.yml new file mode 100644 index 0000000000..a3fec8117f --- /dev/null +++ b/removed/detections/splunk_persistent_xss_via_scheduled_views.yml @@ -0,0 +1,45 @@ +name: Splunk Persistent XSS via Scheduled Views +id: d4f55f7c-6518-4122-a197-951fe0f21b25 +version: 5 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto +data_source: + - Splunk +type: Hunting +status: removed +description: In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.1.2308.211, a low-privileged user that does not hold the “admin” or “power” Splunk roles could craft a malicious payload through Scheduled Views that could result in execution of unauthorized JavaScript code in the browser of a user. +search: |- + `splunkd_ui` method=POST uri=*/scheduledview/search/update* + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(bytes) AS bytes values(uri) AS uri values(useragent) AS user_agent by clientip user host + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_persistent_xss_via_scheduled_views_filter` +how_to_implement: Requires access to REST API. +known_false_positives: This is a hunting search, it is not possible to detect XSS payload from the scheduled view, however it is possible to see who was sent the scheduled search in order to trigger potential XSS. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1010 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45740 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/svd-2024-1010.log + custom_index: _internal + sourcetype: splunkd_ui_access + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml b/removed/detections/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml new file mode 100644 index 0000000000..92bf394be4 --- /dev/null +++ b/removed/detections/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml @@ -0,0 +1,38 @@ +name: Splunk Persistent XSS Via URL Validation Bypass W Dashboard +id: 8a43558f-a53c-4ee4-86c1-30b1e8ef3606 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic detects attempts to bypass URL validation in Splunk Enterprise versions below 9.0.4, 8.2.10, and 8.1.13 by targeting the vulnerable bootstrap version 2.3.1. It leverages `splunkd_web` logs, specifically monitoring GET requests to JavaScript files within the vulnerable bootstrap path. This activity is significant as it can allow a low-privileged user to perform path traversal, potentially accessing restricted and confidential information. If confirmed malicious, this could lead to unauthorized data access and compromise of sensitive information, including targeting admin users. +search: '`splunkd_web` method=GET uri_path="*bootstrap-2.3.1*" file="*.js" | table _time clientip uri_path file status | `splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter`' +how_to_implement: This search does not require additional data to be ingested. This search requires ability to search _internal index. This search helps discover access to vulnerable bootstrap versions. +known_false_positives: This search will produce numerous false positives as it shows ANY accesses to vulnerable bootstrap Javascript files. Accesses to these files occur during normal Splunk usage. To reduce or eliminate false positives, update the a version of Splunk which has addressed the vulnerability. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2019-8331 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_process_injection_forwarder_bundle_downloads.yml b/removed/detections/splunk_process_injection_forwarder_bundle_downloads.yml new file mode 100644 index 0000000000..2f7cfe19f1 --- /dev/null +++ b/removed/detections/splunk_process_injection_forwarder_bundle_downloads.yml @@ -0,0 +1,41 @@ +name: Splunk Process Injection Forwarder Bundle Downloads +id: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: Hunting +description: The following analytic identifies unauthorized forwarder bundle downloads from Splunk Deployment Servers. It leverages native Splunk logs, specifically the `splunkd` component "PackageDownloadRestHandler," to detect instances where an unauthenticated client may have downloaded forwarder bundles. This activity is significant because it could indicate a potential security breach, allowing unauthorized access to sensitive configurations and applications. If confirmed malicious, an attacker could gain insights into the deployment server's environment, potentially leading to further exploitation or lateral movement within the network. +data_source: + - Splunk +search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' +how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: None at this time. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32157 + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_protocol_impersonation_weak_encryption_configuration.yml b/removed/detections/splunk_protocol_impersonation_weak_encryption_configuration.yml new file mode 100644 index 0000000000..159db5201a --- /dev/null +++ b/removed/detections/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -0,0 +1,42 @@ +name: Splunk Protocol Impersonation Weak Encryption Configuration +id: 900892bf-70a9-4787-8c99-546dd98ce461 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: Hunting +description: The following analytic identifies weak encryption configurations in Splunk related to TLS validation within the httplib and urllib Python libraries. It uses REST API calls to check specific configuration settings on the search head and its peers, ensuring compliance with security advisories. This activity is significant for a SOC as weak encryption can be exploited for protocol impersonation attacks, leading to unauthorized access. If confirmed malicious, attackers could intercept and manipulate data, compromising the integrity and confidentiality of the Splunk environment. +data_source: + - Splunk +search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. +references: + - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32151 + mitre_attack_id: + - T1001.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/removed/detections/splunk_protocol_impersonation_weak_encryption_selfsigned.yml new file mode 100644 index 0000000000..e8c5801add --- /dev/null +++ b/removed/detections/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -0,0 +1,42 @@ +name: Splunk protocol impersonation weak encryption selfsigned +id: c76c7a2e-df49-414a-bb36-dce2683770de +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +status: removed +type: Hunting +description: The following analytic identifies the use of Splunk's default self-signed certificates, which are flagged as insecure. It detects events from the `splunkd` log where the event message indicates that an X509 certificate should not be used. This activity is significant because using weak encryption and self-signed certificates can expose the system to man-in-the-middle attacks and other security vulnerabilities. If confirmed malicious, attackers could impersonate Splunk services, intercept sensitive data, and compromise the integrity of the Splunk environment. +data_source: + - Splunk +search: '`splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. +references: + - https://www.splunk.com/en_us/product-security + - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32152 + mitre_attack_id: + - T1588.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.log + source: /opt/splun/var/log/splunk/splunkd.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/removed/detections/splunk_protocol_impersonation_weak_encryption_simplerequest.yml new file mode 100644 index 0000000000..f9f0b5615e --- /dev/null +++ b/removed/detections/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -0,0 +1,42 @@ +name: Splunk protocol impersonation weak encryption simplerequest +id: 839d12a6-b119-4d44-ac4f-13eed95412c8 +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +status: removed +type: Hunting +description: The following analytic identifies instances where Splunk's Python3 client libraries fail to validate SSL certificates properly. It leverages logs from `splunk_python` to detect when "simpleRequest SSL certificate validation is enabled without hostname verification." This activity is significant because improper SSL certificate validation can expose the system to man-in-the-middle attacks, allowing attackers to intercept or alter data. If confirmed malicious, this vulnerability could lead to unauthorized access, data breaches, and potential system compromise. Upgrading to Splunk version 9 and configuring TLS hostname validation is recommended to mitigate this risk. +data_source: + - Splunk +search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +references: + - https://www.splunk.com/en_us/product-security + - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32152 + mitre_attack_id: + - T1588.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunk_python + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml b/removed/detections/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml new file mode 100644 index 0000000000..bb72b87520 --- /dev/null +++ b/removed/detections/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml @@ -0,0 +1,36 @@ +name: Splunk RBAC Bypass On Indexing Preview REST Endpoint +id: bbe26f95-1655-471d-8abd-3d32fafa86f8 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies unauthorized attempts to use the /services/indexing/preview REST endpoint in Splunk. It detects POST requests to this endpoint by monitoring the _internal index for specific URI patterns. This activity is significant because it indicates a potential RBAC (Role-Based Access Control) bypass, allowing unauthorized users to overwrite search results if they know the search ID (SID) of an existing job. If confirmed malicious, this could lead to data manipulation, unauthorized access to sensitive information, and compromised integrity of search results. +search: '`splunkda` method="POST" uri="*/services/indexing/preview*" | table host clientip status useragent user uri_path | `splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter`' +how_to_implement: This search does not require additional data ingestion. It requires the ability to search _internal index. +known_false_positives: This is a hunting search which provides verbose results against this endpoint. Operator must consider things such as IP address, useragent and user(specially low privelege) and host to investigate possible attack. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1134 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134/splunk/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.log + source: splunkd_access.log + sourcetype: splunkd_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_rce_via_external_lookup_copybuckets.yml b/removed/detections/splunk_rce_via_external_lookup_copybuckets.yml new file mode 100644 index 0000000000..dc7f41a4a1 --- /dev/null +++ b/removed/detections/splunk_rce_via_external_lookup_copybuckets.yml @@ -0,0 +1,36 @@ +name: Splunk RCE via External Lookup Copybuckets +id: 8598f9de-bba8-42a4-8ef0-12e1adda4131 +version: 5 +creation_date: '2024-07-01' +modification_date: '2026-05-14' +status: removed +author: Rod Soto, Chase Franklin +type: Hunting +data_source: + - Splunk +description: The following detection provides the ability to detect remote code execution attempts against a script named copybuckets present within the splunk_archiver application by calling this script as an external lookup. +search: 'index=_internal sourcetype="splunk_archiver-too_small" *.csv | rex field=_raw "Invoking command:\s(?<command>.*)" | stats min(_time) as firstTime max(_time) as lastTime values(command) as command values(severity) as severity by host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_rce_via_external_lookup_copybuckets_filter`' +how_to_implement: Requires access to internal indexes +known_false_positives: An operator must identify elements indicatives of command execution requests by looking at regex data being extracted from the log. Not all the requests will be malicious. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0705 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1210 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0705_splunk_archiver_splunk_archiver-too_small.log + source: /opt/splunk/var/log/splunk/splunk_archiver.log + sourcetype: splunk_archiver-too_small + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_rce_via_serialized_session_payload.yml b/removed/detections/splunk_rce_via_serialized_session_payload.yml new file mode 100644 index 0000000000..dba37d4e5d --- /dev/null +++ b/removed/detections/splunk_rce_via_serialized_session_payload.yml @@ -0,0 +1,40 @@ +name: Splunk RCE via Serialized Session Payload +id: d1d8fda6-874a-400f-82cf-dcbb59d8e4db +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk +status: removed +type: Hunting +description: The following analytic detects the execution of a specially crafted query using the 'collect' SPL command in Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1. It leverages audit logs to identify searches containing both 'makeresults' and 'collect' commands. This activity is significant because it can indicate an attempt to serialize untrusted data, potentially leading to arbitrary code execution. If confirmed malicious, this could allow an attacker to execute code within the Splunk environment, leading to unauthorized access and control over the system. +data_source: + - Splunk +search: '`audit_searches` file=* (search="*makeresults*" AND search="*collect*") | stats count min(_time) as firstTime max(_time) as lastTime by action file user splunk_server search | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_rce_via_serialized_session_payload_filter`' +how_to_implement: Requires access to the _audit index. +known_false_positives: There are numerous many uses of the 'makeresults' and 'collect' SPL commands. Please evaluate the results of this search for potential abuse. +references: + - https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-40595 + mitre_attack_id: + - T1190 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_rce_via_serialized_session_payload_audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml b/removed/detections/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml new file mode 100644 index 0000000000..2a02cce60c --- /dev/null +++ b/removed/detections/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml @@ -0,0 +1,40 @@ +name: Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature +id: baa41f09-df48-4375-8991-520beea161be +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +description: The following analytic identifies potential exploitation attempts against the Splunk Secure Gateway App's Mobile Alerts feature in Splunk versions 9.0, 8.2.x, and 8.1.x. It detects suspicious activity by monitoring requests to the mobile alerts endpoint using specific URI paths and query parameters. This activity is significant because an authenticated user could exploit this vulnerability to execute arbitrary operating system commands remotely. If confirmed malicious, this could lead to unauthorized code execution, compromising the integrity and security of the Splunk environment. +data_source: + - Splunk +search: '`splunkda` uri_path="/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" sort="notification.created_at:-1" | table clientip file host method uri_query sort | `splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter`' +how_to_implement: This search only applies if Splunk Mobile Gateway is deployed in the vulnerable Splunk versions. +known_false_positives: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. Focus of this search is "uri_path=/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" which is the injection point. +references: + - https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-43567 + mitre_attack_id: + - T1210 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_secure_gateway_splunk_mobile_alerts_feature.log + source: /opt/splunk/var/log/splunk/splunkd_access.log + sourcetype: splunkd_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_reflected_xss_in_the_templates_lists_radio.yml b/removed/detections/splunk_reflected_xss_in_the_templates_lists_radio.yml new file mode 100644 index 0000000000..25765cd79a --- /dev/null +++ b/removed/detections/splunk_reflected_xss_in_the_templates_lists_radio.yml @@ -0,0 +1,40 @@ +name: Splunk Reflected XSS in the templates lists radio +id: d532d105-c63f-4049-a8c4-e249127ca425 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +description: The following analytic identifies potential reflected cross-site scripting (XSS) attempts in Splunk versions below 8.1.12, 8.2.9, and 9.0.2. It detects when a query parameter with `output_mode=radio` is used in a URI, leveraging `splunkd_webx` logs with status 200 and non-null URI queries. This activity is significant as it can indicate an attempt to exploit a known vulnerability, potentially allowing attackers to execute arbitrary JavaScript in the context of the user's browser. If confirmed malicious, this could lead to unauthorized actions, data theft, or further compromise of the affected Splunk instance. +data_source: + - Splunk +search: '`splunkd_webx` user=admin status=200 uri=*/lists/entities/x/ui/views* uri_query!=null | stats count earliest(_time) as event_time values(status) as status values(clientip) as clientip by index, sourcetype, _time, host, user, uri | `splunk_reflected_xss_in_the_templates_lists_radio_filter`' +how_to_implement: This vulnerability only affects instances with Splunk Web enabled. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. +known_false_positives: This search may produce false positives as it is difficult to pinpoint all possible XSS injection characters in a single search string. Special attention is required to "en-US/list/entities/x/ui/views" which is the vulnerable injection point. +references: + - https://research.splunk.com/stories/splunk_vulnerabilities/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-43568 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_in_templates_lists_radio.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_reflected_xss_on_app_search_table_endpoint.yml b/removed/detections/splunk_reflected_xss_on_app_search_table_endpoint.yml new file mode 100644 index 0000000000..303c9d1c3e --- /dev/null +++ b/removed/detections/splunk_reflected_xss_on_app_search_table_endpoint.yml @@ -0,0 +1,38 @@ +name: Splunk Reflected XSS on App Search Table Endpoint +id: 182f9080-4137-4629-94ac-cb1083ac981a +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies attempts to exploit a reflected cross-site scripting (XSS) vulnerability on the app search table endpoint in Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12. It detects this activity by analyzing web request logs for specific dataset commands (`makeresults`, `count`, `eval`, `baseSPL`) within the `splunkd_web` index. This activity is significant because successful exploitation can lead to the execution of arbitrary commands on the Splunk platform, potentially compromising the entire instance. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and manipulate data within the Splunk environment. +search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats count min(_time) as firstTime max(_time) as lastTime by clientip status user view root uri_path | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_reflected_xss_on_app_search_table_endpoint_filter`' +how_to_implement: Need access to the internal indexes. +known_false_positives: This search will produce false positives. It is necessary to also look at uri_query parameter to determine the possible malicious intention of inserting makeresults within the uri string. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0801 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_on_app_search_table_endpoint_splunk_web_access.log + source: web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_risky_command_abuse_disclosed_february_2023.yml b/removed/detections/splunk_risky_command_abuse_disclosed_february_2023.yml new file mode 100644 index 0000000000..84b8aa0c5f --- /dev/null +++ b/removed/detections/splunk_risky_command_abuse_disclosed_february_2023.yml @@ -0,0 +1,69 @@ +name: Splunk risky Command Abuse disclosed february 2023 +id: ee69374a-d27e-4136-adac-956a96ff60fd +version: 9 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk +status: removed +type: Hunting +description: The following analytic identifies the execution of high-risk commands associated with various Splunk vulnerability disclosures. It leverages the Splunk_Audit.Search_Activity datamodel to detect ad-hoc searches by non-system users that match known risky commands. This activity is significant for a SOC as it may indicate attempts to exploit known vulnerabilities within Splunk, potentially leading to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a severe threat to the organization's security posture. +data_source: + - Splunk +search: '| tstats fillnull_value="N/A" count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command splunk_risky_command as search output splunk_risky_command description vulnerable_versions CVE | where splunk_risky_command != "false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_risky_command_abuse_disclosed_february_2023_filter`' +how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel. +known_false_positives: This search encompasses many commands. +references: + - https://advisory.splunk.com/advisories +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + cve: + - CVE-2023-22931 + - CVE-2023-22934 + - CVE-2023-22935 + - CVE-2023-22936 + - CVE-2023-22939 + - CVE-2023-22940 + - CVE-2023-40598 + - CVE-2023-40598 + - CVE-2023-46214 + - CVE-2024-23676 + - CVE-2024-36984 + mitre_attack_id: + - T1548 + - T1202 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log + source: audittrail + sourcetype: audittrail + custom_index: _audit + - name: True Positive Test runshellscript abuse + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_runshellscript_abuse.log + source: audittrail + sourcetype: audittrail + custom_index: _audit + - name: True Positive Test Additional runshellscript abuse + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/splunk/splunk_cmd_injection_using_external_lookups_audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit + - name: True Positive Test mrollup abuse + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/splunk/splunk_mrollup_abuse_audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_sg_information_disclosure_for_low_privs_user.yml b/removed/detections/splunk_sg_information_disclosure_for_low_privs_user.yml new file mode 100644 index 0000000000..8a85281edc --- /dev/null +++ b/removed/detections/splunk_sg_information_disclosure_for_low_privs_user.yml @@ -0,0 +1,43 @@ +name: Splunk SG Information Disclosure for Low Privs User +id: 0a3d6035-7bef-4dfa-b01e-84349edac3b4 +version: 5 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto +data_source: + - Splunk +type: Hunting +status: removed +description: In Splunk Enterprise versions below 9.3.0, 9.2.1 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the “admin” or “power” Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App. +search: |- + `splunkd_ui` uri_path="*/splunkd/__raw/services/ssg/kvstore/*" user!=admin user!="-" + | stats count by clientip user method uri_path + | `splunk_sg_information_disclosure_for_low_privs_user_filter` +how_to_implement: Requires access to internal indexes. +known_false_positives: This is a hunting search and will produce false positives, the focus of this search must be on unusual requests towards the Splunk Secure Gateway from a non administrator user. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1005 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1087 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45735 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/splunk/svd-2024-1005.log + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log + sourcetype: splunkd_ui_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_stored_xss_conf_web_settings_on_premises.yml b/removed/detections/splunk_stored_xss_conf_web_settings_on_premises.yml new file mode 100644 index 0000000000..92377c27ac --- /dev/null +++ b/removed/detections/splunk_stored_xss_conf_web_settings_on_premises.yml @@ -0,0 +1,39 @@ +name: Splunk Stored XSS conf-web Settings on Premises +id: ed1209ef-228d-4dab-9856-be9369925a5c +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: This hunting detection provides information on exploitation of stored XSS against /configs/conf-web/settings by an admin level user. +search: '`splunk_python` *script* *eval* | stats min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_stored_xss_conf_web_settings_on_premises_filter`' +how_to_implement: Requires access to internal indexes. +known_false_positives: This is a hunting search and will produce false positives, operator must identify XSS elemetns in the splunk_python log related to the vulnerable endpoint. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0717 +tags: + cve: + - CVE-2024-36987 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0717_python_log_splunk_python.log + source: /opt/splunk/var/log/splunk/python.log + sourcetype: splunk_python + custom_index: _internal + +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_stored_xss_via_data_model_objectname_field.yml b/removed/detections/splunk_stored_xss_via_data_model_objectname_field.yml new file mode 100644 index 0000000000..2b316e415a --- /dev/null +++ b/removed/detections/splunk_stored_xss_via_data_model_objectname_field.yml @@ -0,0 +1,41 @@ +name: Splunk Stored XSS via Data Model objectName Field +id: 062bff76-5f9c-496e-a386-cb1adcf69871 +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +description: The following analytic identifies attempts to exploit a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise via the Data Model object name field. It detects this activity by analyzing web access logs (`splunkd_webx`) for specific URI patterns and non-null query parameters. This activity is significant because it allows authenticated users to inject and store malicious scripts, leading to persistent XSS attacks. If confirmed malicious, this could enable attackers to execute arbitrary scripts in the context of other users, potentially leading to data theft, session hijacking, or further compromise of the Splunk environment. +data_source: + - Splunk +search: '`splunkd_webx` uri=/*/splunkd/__raw/servicesNS/*/launcher/datamodel/model* uri_query!=null | stats count by _time host status clientip user uri | `splunk_stored_xss_via_data_model_objectname_field_filter`' +how_to_implement: This vulnerability only affects Splunk Web enabled instances. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. +known_false_positives: This search may produce false positives and does not cover exploitation attempts via code obfuscation, focus of search is suspicious requests against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the injection point. +references: + - https://advisory.splunk.com/advisories/SVD-2022-1109 + - https://portswigger.net/web-security/cross-site-scripting/cheat-sheet +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-43569 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_stored_xss_via_data_model_objectname_field.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_stored_xss_via_specially_crafted_bulletin_message.yml b/removed/detections/splunk_stored_xss_via_specially_crafted_bulletin_message.yml new file mode 100644 index 0000000000..60eed56094 --- /dev/null +++ b/removed/detections/splunk_stored_xss_via_specially_crafted_bulletin_message.yml @@ -0,0 +1,39 @@ +name: Splunk Stored XSS via Specially Crafted Bulletin Message +id: fd852b27-1882-4505-9f2c-64dfb96f4fc1 +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following hunting detection provides fields related to /service/messages endpoints where specially crafted bulletin message can exploit stored XSS. +search: '| rest /services/messages | search message="*http*" | table id author message title | `splunk_stored_xss_via_specially_crafted_bulletin_message_filter`' +how_to_implement: Need access to Splunk REST api data via search. +known_false_positives: Must look at messages field and find malicious suspicious characters or hyperlinks. Not all requests to this endpoint will be malicious. +references: + - https://advisory.splunk.com/SVD-2024-0713 +tags: + cve: + - CVE-2024-36993 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + security_domain: endpoint + manual_test: This search uses a REST call against a running Splunk instance to fetch messages that have been created on the instance. It cannot be replicated with a normal test or attack data as this data cannot be "replayed" into a Splunk instance. +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0713_json_json.log + source: _json + sourcetype: _json + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unauthenticated_dos_via_null_pointer_references.yml b/removed/detections/splunk_unauthenticated_dos_via_null_pointer_references.yml new file mode 100644 index 0000000000..da09a8f8bc --- /dev/null +++ b/removed/detections/splunk_unauthenticated_dos_via_null_pointer_references.yml @@ -0,0 +1,38 @@ +name: Splunk Unauthenticated DoS via Null Pointer References +id: d67594fe-c317-41b8-9319-ec8428d5c2ea +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following hunting search provides information on splunkd crash as a result of a Denial of Service Exploitation via null pointer references which targets 'services/cluster/config' endpoint. +search: '`splunk_crash_log` "Segmentation fault" "POST /services/cluster/config" | stats count min(_time) as firstTime max(_time) as lastTime by host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_unauthenticated_dos_via_null_pointer_references_filter`' +how_to_implement: Requires access to internal indexes. +known_false_positives: This is a hunting search and will produce false positives. An operator needs to find proximity and detail of requests targeting cluster config endpoint and subsequent Segmentation fault in splunk crash log. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0702 +tags: + cve: + - CVE-2024-36983 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0702_splunkd_crash_log_splunkd_crash_log.log + source: /opt/splunk/var/log/splunk/crash-*.log + sourcetype: splunkd_crash_log + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unauthenticated_log_injection_web_service_log.yml b/removed/detections/splunk_unauthenticated_log_injection_web_service_log.yml new file mode 100644 index 0000000000..7bd0f2f791 --- /dev/null +++ b/removed/detections/splunk_unauthenticated_log_injection_web_service_log.yml @@ -0,0 +1,40 @@ +name: Splunk Unauthenticated Log Injection Web Service Log +id: de3908dc-1298-446d-84b9-fa81d37e959b +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies potential log injection attempts into the Splunk server via specially crafted web URLs. It detects ANSI escape codes within the `uri_path` field of `splunkd_webx` logs. This activity is significant as it can lead to log file manipulation, potentially obfuscating malicious actions or misleading analysts. If confirmed malicious, an attacker could manipulate log files to hide their tracks or execute further attacks, compromising the integrity of the logging system and making incident response more challenging. +search: '`splunkd_webx` uri_path IN ("*\x1B*", "*\u001b*", "*\033*", "*\0x9*", "*\0x8*") | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`' +how_to_implement: This only affects web enabled Splunk instances. The detection does require the ability to search the _internal index. +known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voluntarily or by accident. This search will not detect obfuscated ANSI characters. This is not intended to be alerted upon. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0606 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-32712 + mitre_attack_id: + - T1190 + product: + - Splunk Enterprise + - Splunk Enterprise Security + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/web_access.log + source: /opt/splunk/var/log/splunk/web_access.log + custom_index: _internal + sourcetype: splunk_web_access + +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unauthenticated_path_traversal_modules_messaging.yml b/removed/detections/splunk_unauthenticated_path_traversal_modules_messaging.yml new file mode 100644 index 0000000000..dcf2c8fc07 --- /dev/null +++ b/removed/detections/splunk_unauthenticated_path_traversal_modules_messaging.yml @@ -0,0 +1,37 @@ +name: Splunk Unauthenticated Path Traversal Modules Messaging +id: e7c2b064-524e-4d65-8002-efce808567aa +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: This hunting search provides information on exploitation attempts against /modules/messaging endpoint, the exploit can be clearly seen as the ../ which signals an attempt to traverse target directories. +search: '`splunkd_web` method=GET uri_path="/*/modules/messaging/*..*" | stats min(_time) as firstTime max(_time) as lastTime values(method) as method values(uri_path) as uri_path by host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_unauthenticated_path_traversal_modules_messaging_filter`' +how_to_implement: Only applies to Microsoft Windows installations of Splunk. +known_false_positives: May catch other exploitation attempts using path traversal related characters. +references: + - https://advisory.splunk.com/SVD-2024-0711 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1083 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/SVD-2024-0711_web_access_splunk_web_access.log + source: C:\\Program Files\\Splunk\\var\\log\\splunk\\web_access.log + sourcetype: splunk_web_access + custom_index: _internal + +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unauthorized_experimental_items_creation.yml b/removed/detections/splunk_unauthorized_experimental_items_creation.yml new file mode 100644 index 0000000000..722f8d6b4e --- /dev/null +++ b/removed/detections/splunk_unauthorized_experimental_items_creation.yml @@ -0,0 +1,38 @@ +name: Splunk Unauthorized Experimental Items Creation +id: 84afda04-0cd6-466b-869e-70d6407d0a34 +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: This hunting search provides information on finding possible creation of unauthorized items against /experimental endpoint. +search: '`splunkda` */experimental/* method=POST | stats count min(_time) as firstTime max(_time) as lastTime by clientip method uri_path uri status | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_unauthorized_experimental_items_creation_filter`' +how_to_implement: Requires access to internal indexes. +known_false_positives: Not all requests are going to be malicious, there will be false positives, however operator must find suspicious items that might have been created by an unauthorized user. +references: + - https://advisory.splunk.com/SVD-2024-0715 +tags: + cve: + - CVE-2024-36995 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0715_splunkd_splunkd_access.log + source: /opt/splunk/var/log/splunk/splunkd_access.log + sourcetype: splunkd_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unauthorized_notification_input_by_user.yml b/removed/detections/splunk_unauthorized_notification_input_by_user.yml new file mode 100644 index 0000000000..de98e338db --- /dev/null +++ b/removed/detections/splunk_unauthorized_notification_input_by_user.yml @@ -0,0 +1,39 @@ +name: Splunk Unauthorized Notification Input by User +id: 4b7f368f-4322-47f8-8363-2c466f0b7030 +version: 5 +creation_date: '2024-07-01' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: This hunting search provides information to track possible exploitation of a lower privilege user able to push notifications that may include malicious code as notifications for all users in Splunk. +search: '| rest /services/messages | table title message severity timeCreated_iso published splunk_server author | `splunk_unauthorized_notification_input_by_user_filter`' +how_to_implement: Requires access to Splunk rest data. +known_false_positives: This search will produce false positives which may include benign notifications from other Splunk entities, attention to suspicious or anomalous elements in notifications helps identify actual exploitation of this vulnerability. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0709 +tags: + cve: + - CVE-2023-33733 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1548 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/SVD-2024-0709_json_json.json + source: _json + sourcetype: _json + custom_index: _internal + +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml b/removed/detections/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml new file mode 100644 index 0000000000..404f1c26fe --- /dev/null +++ b/removed/detections/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml @@ -0,0 +1,56 @@ +name: Splunk unnecessary file extensions allowed by lookup table uploads +id: b7d1293f-e78f-415e-b5f6-443df3480082 +version: 6 +creation_date: '2023-02-14' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +type: TTP +status: removed +data_source: + - Splunk +description: The following analytic identifies user activity related to uploading lookup tables with unnecessary filename extensions in Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4. It detects this activity by monitoring HTTP methods (POST, DELETE) and specific URI paths in the internal `splunkd_access` logs. This behavior is significant because it can indicate attempts to upload potentially malicious files disguised as lookup tables. If confirmed malicious, this activity could allow an attacker to execute unauthorized code or manipulate data within the Splunk environment, leading to potential data breaches or system compromise. +search: '`splunkda` method IN ("POST", "DELETE") uri_path=/servicesNS/*/ui/views/* | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method=="DELETE" , "Deleted" ) | rex field=uri_path "(?<user_and_app>.*?)\/ui\/views/(?<dashboard_encoded>.*)" | eval dashboard = urldecode( dashboard_encoded ) | table _time, uri_path, user, dashboard, activity, uri_path | `splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter`' +how_to_implement: Requires access to internal splunkd_access. +known_false_positives: This is a hunting search, the search provides information on upload, edit, and delete activity on Lookup Tables. Manual investigation is necessary after executing search. This search will produce false positives as payload cannot be directly discerned. +references: + - https://www.splunk.com/en_us/product-security.html +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential lookup template injection attempt from $user$ on lookup table at path $uri_path$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-22937 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log + source: /opt/splunk/var/log/splunk/splunkd_access.log + sourcetype: splunkd_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_xss_in_highlighted_json_events.yml b/removed/detections/splunk_xss_in_highlighted_json_events.yml new file mode 100644 index 0000000000..64c5cad6c5 --- /dev/null +++ b/removed/detections/splunk_xss_in_highlighted_json_events.yml @@ -0,0 +1,40 @@ +name: Splunk XSS in Highlighted JSON Events +id: 1030bc63-0b37-4ac9-9ae0-9361c955a3cc +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies potential exploitation of a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise 9.1.2. It detects suspicious requests to the Splunk web GUI that may execute JavaScript within script tags. This detection leverages logs from the `splunkd_ui` data source, focusing on specific URI paths and HTTP methods. This activity is significant as it can allow attackers to execute arbitrary JavaScript, potentially accessing the API with the logged-in user's permissions. If the user is an admin, the attacker could create an admin account, leading to full control over the Splunk environment. +search: '`splunkd_ui` "/*/splunkd/__raw/servicesNS/nobody/search/authentication/users" status=201 | stats count min(_time) as firstTime max(_time) as lastTime by clientip, uri_path, method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_xss_in_highlighted_json_events_filter`' +how_to_implement: This search only applies to web-GUI-enabled Splunk instances and operator must have access to internal indexes. +known_false_positives: This is a hunting search and will produce false positives as it is not possible to view contents of a request payload. It shows the artifact resulting from a potential exploitation payload (the creation of a user with admin privileges). +references: + - https://advisory.splunk.com/advisories/SVD-2023-1103 +tags: + cve: + - CVE-2023-46213 + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_highlighted_json_events_splunkd_ui_access.log + source: splunkd_ui_access.log + sourcetype: splunkd_ui_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_xss_in_monitoring_console.yml b/removed/detections/splunk_xss_in_monitoring_console.yml new file mode 100644 index 0000000000..c93024542e --- /dev/null +++ b/removed/detections/splunk_xss_in_monitoring_console.yml @@ -0,0 +1,45 @@ +name: Splunk XSS in Monitoring Console +id: b11accac-6fa3-4103-8a1a-7210f1a67087 +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: TTP +description: The following analytic identifies attempts to exploit a reflective Cross-Site Scripting (XSS) vulnerability in the Splunk Distributed Monitoring Console app. It detects GET requests with suspicious query parameters by analyzing `splunkd_web` logs in the _internal index. This activity is significant because it targets a known vulnerability (CVE-2022-27183) that could allow attackers to execute arbitrary scripts in the context of the user's browser. If confirmed malicious, this could lead to unauthorized actions, data theft, or further compromise of the Splunk environment. +data_source: [] +search: '`splunkd_web` method="GET" uri_query="description=%3C*" | table _time host status clientip user uri | `splunk_xss_in_monitoring_console_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183. +known_false_positives: Use of the monitoring console where the less-than sign (<) is the first character in the description field. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.html +rba: + message: A potential XSS attempt has been detected from $user$ + risk_objects: + - field: host + type: system + score: 40 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-27183 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/xss/splunk_web_access.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_xss_in_save_table_dialog_header_in_search_page.yml b/removed/detections/splunk_xss_in_save_table_dialog_header_in_search_page.yml new file mode 100644 index 0000000000..3fc9340451 --- /dev/null +++ b/removed/detections/splunk_xss_in_save_table_dialog_header_in_search_page.yml @@ -0,0 +1,41 @@ +name: Splunk XSS in Save table dialog header in search page +id: a974d1ee-ddca-4837-b6ad-d55a8a239c20 +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +description: The following analytic identifies persistent cross-site scripting (XSS) attempts in the 'Save Table' dialog on the Splunk search page. It detects POST requests to the endpoint `/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model` containing potential XSS payloads. This activity is significant because it can allow a remote user with the "power" role to inject malicious scripts, leading to persistent XSS vulnerabilities. If confirmed malicious, this could enable attackers to execute arbitrary scripts in the context of the affected user, potentially leading to data theft, session hijacking, or further exploitation within the Splunk environment. +data_source: + - Splunk +search: '`splunkd_webx` method=POST uri=/*/splunkd/__raw/servicesNS/nobody/search/datamodel/model | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`' +how_to_implement: Watch for POST requests combined with XSS script strings or obfuscation against the injection point /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model. +known_false_positives: If host is vulnerable and XSS script strings are inputted they will show up in search. Not all Post requests are malicious as they will show when users create and save dashboards. This search may produce several results with non malicious POST requests. Only affects Splunk Web enabled instances. +references: + - https://advisory.splunk.com/advisories/SVD-2022-1101 + - https://portswigger.net/web-security/cross-site-scripting +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-43561 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_save_table_dialog_in_search_page.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_xss_via_external_urls_in_dashboards_ssrf.yml b/removed/detections/splunk_xss_via_external_urls_in_dashboards_ssrf.yml new file mode 100644 index 0000000000..6ee060d2a4 --- /dev/null +++ b/removed/detections/splunk_xss_via_external_urls_in_dashboards_ssrf.yml @@ -0,0 +1,38 @@ +name: Splunk XSS Via External Urls in Dashboards SSRF +id: b0a67520-ae82-4cf6-b04e-9f6cce56830d +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: This is a hunting search that provides elements to find possible dashboards created with external URL references in order to elicit Server Side Request Forgery from /data/ui/views endpoint. +search: '`splunkd_web` user=* uri_path="/*/manager/permissions/launcher/data/ui/views/*" file=* | stats count min(_time) as firstTime max(_time) as lastTime by clientip user file host method uri_path uri_query | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_xss_via_external_urls_in_dashboards_ssrf_filter`' +how_to_implement: Requires access to internal indexes. +known_false_positives: This is a hunting search and requires an operator to search for specific indicators of Server Side Request Forgery attack against /data/ui/views. It is not possible to grab display the payloads of such requests, so this search provides users, ip addresses, requests, files, and queries that may indicate malicious intent. There will be false positives. +references: + - https://advisory.splunk.com/SVD-2024-0714 +tags: + cve: + - CVE-2024-36994 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0714_web_access_splunk_web_access.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_xss_via_view.yml b/removed/detections/splunk_xss_via_view.yml new file mode 100644 index 0000000000..ec340e219b --- /dev/null +++ b/removed/detections/splunk_xss_via_view.yml @@ -0,0 +1,40 @@ +name: Splunk XSS via View +id: 9ac2bfea-a234-4a18-9d37-6d747e85c2e4 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Splunk +status: removed +type: Hunting +description: The following analytic identifies potential Cross-Site Scripting (XSS) attempts via the 'layoutPanel' attribute in the 'module' tag within XML Views in Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4. It leverages internal logs from "splunk_web_service" and "splunk_python" sourcetypes, focusing on messages containing "loadParams." This activity is significant as it can lead to unauthorized script execution within the Splunk Web interface, potentially compromising the security of the instance. If confirmed malicious, attackers could execute arbitrary scripts, leading to data theft, session hijacking, or further exploitation of the Splunk environment. +data_source: + - Splunk +search: 'index = _internal sourcetype IN ("splunk_web_service", "splunk_python") message="*loadParams*" | `security_content_ctime(_time)` | table _time message fileName | `splunk_xss_via_view_filter`' +how_to_implement: This data is collected by default in Splunk. Upon first enabling this rule, a number of errors may be observed. Those that are due to improperly formatted, but non-nefarious, XML views should be be remedied in the corresponding view. Please take care investigating potential XSS as accessing an affected page could retrigger the exploit. +known_false_positives: The error detected above can be generated for a wide variety of improperly formatted XML views. There will be false positives as the search cannot extract the malicious payload and the view should be manually investigated. +references: + - https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-22933 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log + source: /opt/splunk/var/log/splunk/web_service.log + sourcetype: splunk_web_service + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/stories/splunk_vulnerabilities.yml b/stories/splunk_vulnerabilities.yml new file mode 100644 index 0000000000..39a7a51fd7 --- /dev/null +++ b/stories/splunk_vulnerabilities.yml @@ -0,0 +1,18 @@ +name: Splunk Vulnerabilities +id: 5354df00-dce2-48ac-9a64-8adb48006828 +version: 3 +creation_date: '2019-10-16' +modification_date: '2026-06-24' +author: Lou Stella, Rod Soto, Eric McGinnis, Splunk +status: production +description: Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. +narrative: This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. +references: + - https://advisory.splunk.com/ +category: + - Best Practices +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Application Security From 22c4660d24c0cb075abdb9dd890b4a9aa2ea1765 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins <raylee@hawkinsops.com> Date: Thu, 25 Jun 2026 05:58:31 -0500 Subject: [PATCH 015/164] Update Windows EDRSilencer renamed binary detection coverage (#4123) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .../endpoint/windows_edrsilencer_execution.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_edrsilencer_execution.yml b/detections/endpoint/windows_edrsilencer_execution.yml index 78685c9148..6f62d3f3cf 100644 --- a/detections/endpoint/windows_edrsilencer_execution.yml +++ b/detections/endpoint/windows_edrsilencer_execution.yml @@ -1,8 +1,8 @@ name: Windows EDRSilencer Execution id: a206324d-4945-4b0c-a731-87c311ddae2f -version: 2 +version: 3 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-06-13' author: Raven Tait, Splunk status: production type: Anomaly @@ -27,7 +27,7 @@ search: |- Processes.process_name="EDRSilencer.exe" OR ( - Processes.process="*blockedr *" + Processes.process IN ("* blockedr", "* blockedr *") NOT Processes.process="*blockedreport*" ) @@ -42,7 +42,7 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_edrsilencer_execution_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, parent process, and complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Some legitimate administrative tools or security workflows may use similar techniques to block or filter EDR traffic for maintenance or troubleshooting. Verify the context and authorized use before flagging. references: - https://github.com/netero1010/EDRSilencer @@ -60,10 +60,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: Potential EDRSilencer execution observed on $dest$ via $process$. + message: Potential EDRSilencer execution [$process_path$] with the CommandLine [$process$] observed on $dest$. threat_objects: - field: parent_process_name type: parent_process_name + - field: process_name + type: process_name analytic_story: - Security Solution Tampering asset_type: Endpoint From 2fa0452ad6bedee05ff695d6a00f9c55cab03617 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 29 Jun 2026 08:52:05 -0700 Subject: [PATCH 016/164] Explicitly list all apps in this repo's install.yml (#4138) --- install.yml | 43 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 41 insertions(+), 2 deletions(-) diff --git a/install.yml b/install.yml index b5d170f591..666032994e 100644 --- a/install.yml +++ b/install.yml @@ -1,3 +1,42 @@ apps: - - appid: DA-ESS-ContentUpdate - hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz + - appid: DA-ESS-ContentUpdate + hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz + - appid: SplunkEnterpriseSecuritySuite + url: https://splunkbase.splunk.com/app/263 + version: 8.5.1 + - appid: Splunk_TA_microsoft-iis + url: https://splunkbase.splunk.com/app/3185 + version: 2.0.0 + - appid: TA-suricata-4 + url: https://splunkbase.splunk.com/app/4242 + version: 2.3.4 + - appid: Splunk_TA_stream + url: https://splunkbase.splunk.com/app/5238 + version: 8.1.6 + - appid: Splunk_TA_stream_wire_data + url: https://splunkbase.splunk.com/app/5234 + version: 8.1.6 + - appid: TA-Zscaler_CIM + url: https://splunkbase.splunk.com/app/3865 + version: 4.1.5 + - appid: Splunk_TA_aws-kinesis-firehose + url: https://splunkbase.splunk.com/app/3719 + version: 1.3.2 + - appid: Splunk_TA_google-cloudplatform + url: https://splunkbase.splunk.com/app/3088 + version: 5.0.3 + - appid: utbox + url: https://splunkbase.splunk.com/app/2734 + version: 1.9.4 + - appid: SA-admon + url: https://splunkbase.splunk.com/app/6853 + version: 1.1.2 + - appid: TA-crowdstrike-falcon-event-streams + url: https://splunkbase.splunk.com/app/5082 + version: 3.7.2 + - appid: SA-VMWIndex + url: https://splunkbase.splunk.com/app/5640 + version: 4.0.4 + - appid: Splunk_SA_CIM + url: https://splunkbase.splunk.com/app/1621 + version: 8.5.0 From ed64dfe9a045aa5299f91322fc8654214a035114 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 09:13:48 +0000 Subject: [PATCH 017/164] Bump actions/checkout from 6 to 7 (#4135) Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> --- .github/workflows/appinspect.yml | 2 +- .github/workflows/build-response-templates.yml | 2 +- .github/workflows/build.yml | 2 +- .github/workflows/datasource-dependabot.yml | 2 +- .github/workflows/labeler.yml | 2 +- .github/workflows/unit-testing.yml | 2 +- .github/workflows/update_splunk_tas.yml | 2 +- .github/workflows/yaml-validation.yml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 6eab313976..36be91d3b6 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up Python uses: actions/setup-python@v6 diff --git a/.github/workflows/build-response-templates.yml b/.github/workflows/build-response-templates.yml index 5af3719003..075f46864e 100644 --- a/.github/workflows/build-response-templates.yml +++ b/.github/workflows/build-response-templates.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - uses: actions/setup-python@v6 with: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 323fe27295..7b65e00145 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up Python uses: actions/setup-python@v6 diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 0b07ac92a3..0841808720 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -11,7 +11,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: 'develop' token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index f9383b78c0..3dce58e0d5 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -9,7 +9,7 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: repository: "splunk/security_content" - uses: actions/labeler@v6 diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 486722289f..39f11ee0b2 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -9,7 +9,7 @@ jobs: steps: #For fork PRs, always check out security_content and the PR target in security content! - name: Check out the repository code - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: repository: 'splunk/security_content' #this should be the TARGET repo of the PR. we hardcode it for now ref: ${{ github.base_ref }} diff --git a/.github/workflows/update_splunk_tas.yml b/.github/workflows/update_splunk_tas.yml index 2fcce67b1f..0caa429b36 100644 --- a/.github/workflows/update_splunk_tas.yml +++ b/.github/workflows/update_splunk_tas.yml @@ -11,7 +11,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: 'develop' diff --git a/.github/workflows/yaml-validation.yml b/.github/workflows/yaml-validation.yml index e9bf0ad42b..3ddfdf9435 100644 --- a/.github/workflows/yaml-validation.yml +++ b/.github/workflows/yaml-validation.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 From d4026db34edd44fe07fcf2fc1394628068862e53 Mon Sep 17 00:00:00 2001 From: Andrei Banaru <andrei.banaru@gmail.com> Date: Wed, 1 Jul 2026 11:17:23 +0200 Subject: [PATCH 018/164] chore: swap order of macros (#4144) Co-authored-by: Andrei Banaru <a.banaru@iaea.org> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> --- detections/endpoint/attacker_tools_on_endpoint.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index aeeadc47d7..c2a61d01a2 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,8 +1,8 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 18 +version: 19 creation_date: '2021-07-12' -modification_date: '2026-05-13' +modification_date: '2026-07-01' author: Bhavin Patel, Splunk, sventec, Github Community status: production type: TTP @@ -39,9 +39,9 @@ search: |- Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS process_name OUTPUT description | search description !=false | `attacker_tools_on_endpoint_filter` From bf13c80ad9e58e5e901986a9e963df5cf93d8405 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Wed, 1 Jul 2026 11:18:59 +0200 Subject: [PATCH 019/164] update IF config (#4142) Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> --- .../powershell_domain_enumeration.yml | 41 ++++++++------ ...ershell_environment_variable_execution.yml | 20 +++++-- ...ding_dotnet_into_memory_via_reflection.yml | 14 +++-- .../powershell_processing_stream_of_data.yml | 45 ++++++++------- ...hell_remove_windows_defender_directory.yml | 42 +++++++++----- ...ll_windows_defender_exclusion_commands.yml | 55 +++++++++++-------- ...ndows_clipboard_data_via_get_clipboard.yml | 39 +++++++------ ...ows_powershell_import_applocker_policy.yml | 53 ++++++++++-------- ...ndows_powershell_logoff_user_via_quser.yml | 40 +++++++++----- 9 files changed, 211 insertions(+), 138 deletions(-) diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index d7609146c6..af8dd8778b 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -1,19 +1,32 @@ name: PowerShell Domain Enumeration id: e1866ce2-ca22-11eb-8e44-acde48001122 -version: 15 +version: 16 creation_date: '2021-06-15' -modification_date: '2026-05-13' +modification_date: '2026-06-28' author: Michael Haag, Splunk status: production -type: TTP -description: The following analytic detects the execution of PowerShell commands used for domain enumeration, such as `get-netdomaintrust` and `get-adgroupmember`. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. This activity is significant as it often indicates reconnaissance efforts by an attacker to map out the domain structure and identify key users and groups. If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, and unauthorized access to sensitive information within the domain. +type: Anomaly +description: |- + The following analytic detects the execution of PowerShell commands used for domain enumeration, such as `get-netdomaintrust` and `get-adgroupmember`. + It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. + This activity is significant as it often indicates reconnaissance efforts by an attacker to map out the domain structure and identify key users and groups. + If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, and unauthorized access to sensitive information within the domain. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*) - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id + `powershell` + EventCode=4104 + ScriptBlockText IN ( + *get-netdomaintrust*, + *get-netforesttrust*, + *get-addomain*, + *get-adgroupmember*, + *get-domainuser* + ) + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + BY dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId @@ -22,7 +35,7 @@ search: |- | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter` how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. -known_false_positives: It is possible there will be false positives, filter as needed. +known_false_positives: Legitimate use can be common or expected in certain environments. Filter as needed. references: - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 @@ -38,18 +51,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A suspicious powershell script contains domain enumeration command in $ScriptBlockText$ in host $dest$ - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A suspicious powershell script contains domain enumeration command in $ScriptBlockText$ in host $dest$ + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] contains domain enumeration commands executed on host $dest$ analytic_story: - Hermetic Wiper - Malicious PowerShell diff --git a/detections/endpoint/powershell_environment_variable_execution.yml b/detections/endpoint/powershell_environment_variable_execution.yml index 386adfb99e..235dd1f2e9 100644 --- a/detections/endpoint/powershell_environment_variable_execution.yml +++ b/detections/endpoint/powershell_environment_variable_execution.yml @@ -1,12 +1,16 @@ name: PowerShell Environment Variable Execution id: 02c1d8e9-044c-401f-906c-cc95445af8bd -version: 2 +version: 3 creation_date: '2026-04-29' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects the execution of PowerShell scripts that combine environment variable access (`$env:` or `[Environment]::SetEnvironmentVariable`) with `Invoke-Expression` or its alias `iex` to dynamically construct and run code at runtime. This technique is commonly used by adversaries to stage and execute payloads by embedding commands or encoded content inside environment variables, then evaluating them on the fly — effectively hiding the true execution intent from static inspection. Detection is based on PowerShell Script Block Logging (Event ID 4104), which captures the de-obfuscated script block before it executes. Triggering this analytic indicates a potential attempt to execute environment-variable-stored code, a behavior observed in malware loaders and stagers, including those associated with the VIP Keylogger campaign. +description: |- + The following analytic detects the execution of PowerShell scripts that combine environment variable access (`$env:` or `[Environment]::SetEnvironmentVariable`) with `Invoke-Expression` or its alias `iex` to dynamically construct and run code at runtime. + This technique is commonly used by adversaries to stage and execute payloads by embedding commands or encoded content inside environment variables, then evaluating them on the fly — effectively hiding the true execution intent from static inspection. + Detection is based on PowerShell Script Block Logging (Event ID 4104), which captures the de-obfuscated script block before it executes. + Triggering this analytic indicates a potential attempt to execute environment-variable-stored code, a behavior observed in malware loaders and stagers, including those associated with the VIP Keylogger campaign. data_source: - Powershell Script Block Logging 4104 search: |- @@ -22,8 +26,12 @@ search: |- ScriptBlockText="*[Environment]::SetEnvironmentVariable*" | regex ScriptBlockText="(?i)((invoke-expression|iex\s+|\biex\b).*\$env:|\[scriptblock\]::create\s*\(\s*\$env:[^)]+\)\s*(?:\.\s*invoke\s*\(\s*\))?)" | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id user_id + vendor_product EventID Guid + Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_environment_variable_execution_filter` @@ -49,7 +57,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: A suspicious powershell script execute environment variable in [$ScriptBlockText$] on host [$dest$] + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] executed an environment variable on host $dest$ analytic_story: - VIP Keylogger asset_type: Endpoint diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index d4ebee3963..2cb74860b7 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,12 +1,16 @@ name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 -version: 18 +version: 19 creation_date: '2021-06-15' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Michael Haag, Teoderick Contreras Splunk status: production type: Anomaly -description: The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. +description: |- + The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike. + It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. + This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses. + If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. data_source: - Powershell Script Block Logging 4104 search: |- @@ -55,11 +59,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory in host $dest$ + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing reflective class assembly commands to load .net code in memory was executed on host $dest$ - field: user_id type: user score: 20 - message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory in host $dest$ + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing reflective class assembly commands to load .net code in memory was executed on host $dest$ by user $user_id$ analytic_story: - Winter Vivern - AgentTesla diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 9a50398177..eb231a5628 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -1,23 +1,34 @@ name: Powershell Processing Stream Of Data id: 0d718b52-c9f1-11eb-bc61-acde48001122 -version: 18 +version: 19 creation_date: '2021-06-14' -modification_date: '2026-06-08' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects suspicious PowerShell script execution involving compressed stream data processing, identified via EventCode 4104. It leverages PowerShell Script Block Logging to flag scripts using `IO.Compression`, `IO.StreamReader`, or decompression methods. This activity is significant as it often indicates obfuscated PowerShell or embedded .NET/binary execution, which are common tactics for evading detection. If confirmed malicious, this behavior could allow attackers to execute hidden code, escalate privileges, or maintain persistence within the environment. +type: Anomaly +description: |- + The following analytic detects suspicious PowerShell script execution involving compressed stream data processing, identified via EventCode 4104. + It leverages PowerShell Script Block Logging to flag scripts using `IO.Compression`, `IO.StreamReader`, or decompression methods. + This activity is significant as it often indicates obfuscated PowerShell or embedded .NET/binary execution, which are common tactics for evading detection. + If confirmed malicious, this behavior could allow attackers to execute hidden code, escalate privileges, or maintain persistence within the environment. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 ScriptBlockText = "*IO.Compression.*" OR ScriptBlockText = "*IO.StreamReader*" OR ScriptBlockText = "*]::Decompress*" - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id - user_id vendor_product EventID - Guid Opcode Name - Path ProcessID ScriptBlockId - ScriptBlockText + `powershell` + EventCode=4104 + ScriptBlockText IN ( + "*IO.Compression.*", + "*IO.StreamReader*", + "*]::Decompress*" + ) + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter` @@ -40,18 +51,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A suspicious powershell script contains stream command in $ScriptBlockText$ commonly for processing compressed or to decompressed binary file with EventCode $EventID$ in host $dest$ - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A suspicious powershell script contains stream command in $ScriptBlockText$ commonly for processing compressed or to decompressed binary file with EventCode $EventID$ in host $dest$ + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing stream commands to process compressed or decompressed binary file was executed on host $dest$ analytic_story: - Hellcat Ransomware - Malicious PowerShell diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index 10dd5b0b23..02c1d12e89 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -1,15 +1,33 @@ name: Powershell Remove Windows Defender Directory id: adf47620-79fa-11ec-b248-acde48001122 -version: 16 +version: 17 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects a suspicious PowerShell command attempting to delete the Windows Defender directory. It leverages PowerShell Script Block Logging to identify commands containing "rmdir" and targeting the Windows Defender path. This activity is significant as it may indicate an attempt to disable or corrupt Windows Defender, a key security component. If confirmed malicious, this action could allow an attacker to bypass endpoint protection, facilitating further malicious activities without detection. +type: Anomaly +description: |- + The following analytic detects a suspicious PowerShell command attempting to delete the Windows Defender directory. + It leverages PowerShell Script Block Logging to identify commands containing "rmdir" and targeting the Windows Defender path. + This activity is significant as it may indicate an attempt to disable or corrupt Windows Defender, a key security component. + If confirmed malicious, this action could allow an attacker to bypass endpoint protection, facilitating further malicious activities without detection. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText = "*\\Microsoft\\Windows Defender*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remove_windows_defender_directory_filter`' +search: |- + `powershell` + EventCode=4104 + ScriptBlockText = "*rmdir *" + ScriptBlockText = "*\\Microsoft\\Windows Defender*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id user_id + vendor_product EventID Guid Opcode + Name Path ProcessID + ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_remove_windows_defender_directory_filter` how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. known_false_positives: No false positives have been identified at this time. references: @@ -23,18 +41,16 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: suspicious powershell script $ScriptBlockText$ was executed on the $dest$ - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: suspicious powershell script $ScriptBlockText$ was executed on the $dest$ + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing rmdir commands to potentially delete the Windows Defender directory was executed on host $dest$ by user $user_id$ + - field: user_id + type: user + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing rmdir commands to potentially delete the Windows Defender directory was executed on host $dest$ by user $user_id$ analytic_story: - Data Destruction - WhisperGate diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index fb2ad11876..85183c7714 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -1,26 +1,37 @@ name: Powershell Windows Defender Exclusion Commands id: 907ac95c-4dd9-11ec-ba2c-acde48001122 -version: 16 +version: 17 creation_date: '2021-11-25' -modification_date: '2026-06-08' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the use of PowerShell commands to add or set Windows Defender exclusions. It leverages EventCode 4104 to identify suspicious `Add-MpPreference` or `Set-MpPreference` commands with exclusion parameters. This activity is significant because adversaries often use it to bypass Windows Defender, allowing malicious code to execute without detection. If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected. +type: Anomaly +description: |- + The following analytic detects the use of PowerShell commands to add or set Windows Defender exclusions. + It leverages EventCode 4104 to identify suspicious `Add-MpPreference` or `Set-MpPreference` commands with exclusion parameters. + This activity is significant because adversaries often use it to bypass Windows Defender, allowing malicious code to execute without detection. + If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 (ScriptBlockText = "*Add-MpPreference *" OR ScriptBlockText = "*Set-MpPreference *") AND ScriptBlockText = "*-exclusion*" - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id - user_id vendor_product EventID - Guid Opcode Name - Path ProcessID ScriptBlockId - ScriptBlockText - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_windows_defender_exclusion_commands_filter` + `powershell` + EventCode=4104 + ScriptBlockText IN ( + "*Add-MpPreference *", + "*Set-MpPreference *" + ) + ScriptBlockText = "*-exclusion*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_windows_defender_exclusion_commands_filter` how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. known_false_positives: admin or user may choose to use this windows features. references: @@ -36,18 +47,16 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Exclusion command $ScriptBlockText$ executed on $dest$ - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: Exclusion command $ScriptBlockText$ executed on $dest$ + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing exclusion commands to add or set Windows Defender exclusions was executed on host $dest$ + - field: user_id + type: user + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing exclusion commands to add or set Windows Defender exclusions was executed on host $dest$ by user $user_id$ analytic_story: - CISA AA22-320A - AgentTesla diff --git a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml index fca31dc11a..46cd630318 100644 --- a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml +++ b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml @@ -1,26 +1,33 @@ name: Windows ClipBoard Data via Get-ClipBoard id: ab73289e-2246-4de0-a14b-67006c72a893 -version: 11 +version: 12 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the execution of the PowerShell command 'Get-Clipboard' to retrieve clipboard data. It leverages PowerShell Script Block Logging (EventCode 4104) to identify instances where this command is used. This activity is significant because it can indicate an attempt to steal sensitive information such as usernames, passwords, or other confidential data copied to the clipboard. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, potentially compromising user accounts and other critical assets. +description: |- + The following analytic detects the execution of the PowerShell command 'Get-Clipboard' to retrieve clipboard data. + It leverages PowerShell Script Block Logging (EventCode 4104) to identify instances where this command is used. + This activity is significant because it can indicate an attempt to steal sensitive information such as usernames, passwords, or other confidential data copied to the clipboard. + If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, potentially compromising user accounts and other critical assets. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 ScriptBlockText = "*Get-Clipboard*" - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id - user_id vendor_product EventID - Guid Opcode Name - Path ProcessID ScriptBlockId - ScriptBlockText - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_clipboard_data_via_get_clipboard_filter` + `powershell` + EventCode=4104 + ScriptBlockText = "*Get-Clipboard*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_clipboard_data_via_get_clipboard_filter` how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. known_false_positives: It is possible there will be false positives, filter as needed. references: @@ -41,11 +48,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: Powershell script $ScriptBlockText$ execute Get-Clipboard commandlet on $dest$ + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Get-Clipboard commandlet to retrieve clipboard data was executed on host $dest$ - field: user_id type: user score: 20 - message: Powershell script $ScriptBlockText$ execute Get-Clipboard commandlet on $dest$ + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Get-Clipboard commandlet to retrieve clipboard data was executed on host $dest$ by user $user_id$ analytic_story: - Windows Post-Exploitation - Prestige Ransomware diff --git a/detections/endpoint/windows_powershell_import_applocker_policy.yml b/detections/endpoint/windows_powershell_import_applocker_policy.yml index 332e5ff9fd..603a840dc1 100644 --- a/detections/endpoint/windows_powershell_import_applocker_policy.yml +++ b/detections/endpoint/windows_powershell_import_applocker_policy.yml @@ -1,26 +1,35 @@ name: Windows Powershell Import Applocker Policy id: 102af98d-0ca3-4aa4-98d6-7ab2b98b955a -version: 13 +version: 14 creation_date: '2022-06-30' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the import of Windows PowerShell Applocker cmdlets, specifically identifying the use of "Import-Module Applocker" and "Set-AppLockerPolicy" with an XML policy. It leverages PowerShell Script Block Logging (EventCode 4104) to capture and analyze script block text. This activity is significant as it may indicate an attempt to enforce restrictive Applocker policies, potentially used by malware like Azorult to disable antivirus products. If confirmed malicious, this could allow an attacker to bypass security controls, leading to further system compromise and persistence. +type: Anomaly +description: |- + The following analytic detects the import of Windows PowerShell Applocker cmdlets, specifically identifying the use of "Import-Module Applocker" and "Set-AppLockerPolicy" with an XML policy. + It leverages PowerShell Script Block Logging (EventCode 4104) to capture and analyze script block text. + This activity is significant as it may indicate an attempt to enforce restrictive Applocker policies, potentially used by malware like Azorult to disable antivirus products. + If confirmed malicious, this could allow an attacker to bypass security controls, leading to further system compromise and persistence. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 ScriptBlockText="*Import-Module Applocker*" ScriptBlockText="*Set-AppLockerPolicy*" ScriptBlockText="* -XMLPolicy *" - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id - user_id vendor_product EventID - Guid Opcode Name - Path ProcessID ScriptBlockId - ScriptBlockText - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_powershell_import_applocker_policy_filter` + `powershell` + EventCode=4104 + ScriptBlockText="*Import-Module Applocker*" + ScriptBlockText="*Set-AppLockerPolicy*" + ScriptBlockText="* -XMLPolicy *" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_import_applocker_policy_filter` how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. known_false_positives: administrators may execute this command that may cause some false positive. references: @@ -34,18 +43,16 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A PowerShell script contains Import Applocker Policy command $ScriptBlockText$ on host $dest$ - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A PowerShell script contains Import Applocker Policy command $ScriptBlockText$ on host $dest$ + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Import-Module Applocker and Set-AppLockerPolicy commands to import Applocker policy was executed on host $dest$ + - field: user_id + type: user + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Import-Module Applocker and Set-AppLockerPolicy commands to import Applocker policy was executed on host $dest$ by user $user_id$ analytic_story: - Azorult asset_type: Endpoint diff --git a/detections/endpoint/windows_powershell_logoff_user_via_quser.yml b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml index e438b2ab2e..7061caf78c 100644 --- a/detections/endpoint/windows_powershell_logoff_user_via_quser.yml +++ b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml @@ -1,26 +1,32 @@ name: Windows Powershell Logoff User via Quser id: 6d70780d-4cfe-4820-bafd-1b43941986b5 -version: 8 +version: 9 creation_date: '2024-12-13' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: "The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation." +description: |- + The following analytic detects the process of logging off a user through the use of the quser and logoff commands. + By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. + This detection helps identify potential misuse or malicious activity where a user's access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 ScriptBlockText = "*quser*logoff*" - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id - user_id vendor_product EventID - Guid Opcode Name - Path ProcessID ScriptBlockId - ScriptBlockText - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_powershell_logoff_user_via_quser_filter` + `powershell` + EventCode=4104 + ScriptBlockText = "*quser*logoff*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_logoff_user_via_quser_filter` how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: Administrators or power users may use this command. references: @@ -39,7 +45,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: Powershell process having commandline [$ScriptBlockText$] used to logoff user on [$dest$]. + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing quser and logoff commands to potentially logoff user was executed on host $dest$ + - field: user_id + type: user + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing quser and logoff commands to potentially logoff user was executed on host $dest$ by user $user_id$ analytic_story: - Crypto Stealer asset_type: Endpoint From 6ef92e519fcfbfdb87af9a1b7110d9b65107b1e5 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Wed, 1 Jul 2026 12:21:16 +0200 Subject: [PATCH 020/164] Add New Analytics Related to Phantom Stealer (#4137) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> --- ..._or_script_creation_in_suspicious_path.yml | 5 +- ...tables_or_script_creation_in_temp_path.yml | 5 +- .../endpoint/headless_browser_usage.yml | 5 +- ...e_process_accessing_chrome_default_dir.yml | 5 +- ...fox_process_access_firefox_profile_dir.yml | 5 +- .../endpoint/powershell_4104_hunting.yml | 5 +- ...script_contains_base64_encoded_content.yml | 5 +- ...ll_pinvoke_process_injection_api_chain.yml | 5 +- .../registry_keys_used_for_persistence.yml | 5 +- ..._autostart_execution_in_startup_folder.yml | 5 +- ...er_process_launched_with_unusual_flags.yml | 7 +- ...um_browser_no_security_sandbox_process.yml | 7 +- ...rowser_with_custom_user_data_directory.yml | 5 +- ...ial_access_from_browser_password_store.yml | 5 +- ...sword_stores_chrome_copied_in_temp_dir.yml | 5 +- ...assword_stores_chrome_extension_access.yml | 41 +++++++++-- ...ssword_stores_chrome_localstate_access.yml | 43 +++++++++-- ...ssword_stores_chrome_login_data_access.yml | 43 +++++++++-- ...s_disable_or_modify_tools_via_taskkill.yml | 5 +- ...indows_disable_or_stop_browser_process.yml | 5 +- ...er_protocol_in_non_common_process_path.yml | 5 +- ...non_discord_app_access_discord_leveldb.yml | 5 +- ...dows_powershell_cryptography_namespace.yml | 5 +- ...indows_process_injection_remote_thread.yml | 5 +- ...cess_injection_with_public_source_path.yml | 5 +- .../windows_suspicious_process_file_path.yml | 5 +- ...em_network_connections_discovery_netsh.yml | 35 +++++---- ...outlook_credentials_access_in_registry.yml | 5 +- ...ws_unusual_filezilla_xml_config_access.yml | 5 +- ...rocess_load_mozilla_nss_mozglue_module.yml | 5 +- ...s_winscp_configuration_security_access.yml | 71 +++++++++++++++++++ ...picious_process_with_discord_dns_query.yml | 5 +- ..._dns_query_request_by_telegram_bot_api.yml | 5 +- lookups/csv/browser_app_list.csv | 69 +++++++++++++++++- lookups/csv/browser_app_list.yml | 4 +- stories/phantom_stealer.yml | 44 ++++++++++++ 36 files changed, 403 insertions(+), 91 deletions(-) create mode 100644 detections/endpoint/windows_winscp_configuration_security_access.yml create mode 100644 stories/phantom_stealer.yml diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 3e652f2994..c14be99c02 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 28 +version: 29 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -138,6 +138,7 @@ analytic_story: - Void Manticore - Axios Supply Chain Post Compromise - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 598c7fa87e..6f4f9aa1ce 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 25 +version: 26 creation_date: '2021-05-07' -modification_date: '2026-06-11' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -132,6 +132,7 @@ analytic_story: - VIP Keylogger - RoguePlanet - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/headless_browser_usage.yml b/detections/endpoint/headless_browser_usage.yml index 0bdd9aadf5..d0bf216862 100644 --- a/detections/endpoint/headless_browser_usage.yml +++ b/detections/endpoint/headless_browser_usage.yml @@ -1,8 +1,8 @@ name: Headless Browser Usage id: 869ba261-c272-47d7-affe-5c0aa85c93d6 -version: 10 +version: 11 creation_date: '2023-09-11' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Michael Haag, Teoderick Contreras, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ threat_objects: analytic_story: - Browser Hijacking - Forest Blizzard + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1497 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 6502ac2a3d..9eed7ce0f7 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,8 +1,8 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: 19 +version: 20 creation_date: '2021-09-15' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -50,6 +50,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index eb994db77b..bdd370d7ef 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,8 +1,8 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: 19 +version: 20 creation_date: '2021-09-15' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,6 +52,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 657df258aa..8428f645ad 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,8 +1,8 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 26 +version: 27 creation_date: '2021-08-19' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Michael Haag, Splunk status: production type: Hunting @@ -85,6 +85,7 @@ analytic_story: - MuddyWater - Axios Supply Chain Post Compromise - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 5ce2244b6c..9343d1a1b2 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -1,8 +1,8 @@ name: Powershell Fileless Script Contains Base64 Encoded Content id: 8acbc04c-c882-11eb-b060-acde48001122 -version: 21 +version: 22 creation_date: '2021-06-09' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Michael Haag, Splunk status: production type: TTP @@ -53,6 +53,7 @@ analytic_story: - Axios Supply Chain Post Compromise - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1027 diff --git a/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml b/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml index be300e3118..5474df66a4 100644 --- a/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml +++ b/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml @@ -1,8 +1,8 @@ name: PowerShell PInvoke Process Injection API Chain id: 3f1a2b4c-d5e6-7890-abcd-ef1234567890 -version: 2 +version: 3 creation_date: '2026-04-29' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -103,6 +103,7 @@ intermediate_findings: message: A PowerShell script Script block ID [$ScriptBlockId$] contains a possible P-Invoke process injection API chain via either inline Add-Type class declaration or direct static method invocation on [$dest$] analytic_story: - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1055.001 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 4a8943311b..af50fd3916 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,8 +1,8 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 33 +version: 34 creation_date: '2020-04-29' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -82,6 +82,7 @@ analytic_story: - Gh0st RAT - Axios Supply Chain Post Compromise - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 91dcfb0218..6b3f2e9d5f 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -1,8 +1,8 @@ name: Windows Boot or Logon Autostart Execution In Startup Folder id: 99d157cb-923f-4a00-aee9-1f385412146f -version: 15 +version: 16 creation_date: '2023-01-16' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ analytic_story: - APT37 Rustonotto and FadeStealer - PromptFlux - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml b/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml index dbb903e277..d57c7b2711 100644 --- a/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml +++ b/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml @@ -1,15 +1,15 @@ name: Windows Browser Process Launched with Unusual Flags id: 841e2abc-0442-4e7f-b445-b22680632a08 -version: 4 +version: 5 creation_date: '2023-09-19' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects the use of unusual browser flags, specifically --mute-audio and --do-not-elevate, which deviate from standard browser launch behavior. These flags may indicate automated scripts, testing environments, or attempts to modify browser functionality for silent operation or restricted privilege execution. Detection focuses on non-standard launch parameters, unexpected process behavior, or deviations from baseline configurations. Monitoring such flag usage helps identify potentially suspicious activity, misconfigurations, or policy violations, enabling security teams to investigate anomalies, ensure system compliance, and differentiate legitimate administrative or testing uses from unusual or unauthorized operations. data_source: - Sysmon EventID 1 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "explorer.exe")) AND NOT (Processes.parent_process_path IN("C:\\Program Files*", "C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*",)) AND Processes.process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe") AND Processes.process IN ("*--mute-audio*","*--no-de-elevate*", "*--do-not-de-elevate*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_browser_process_launched_with_unusual_flags_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "explorer.exe")) AND NOT (Processes.parent_process_path IN("C:\\Program Files*", "C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*",)) AND Processes.process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe") AND Processes.process IN ("*--mute-audio*","*--no-de-elevate*", "*--do-not-de-elevate*", "*--disable-audio*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_browser_process_launched_with_unusual_flags_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: It is possible false positives will be present based on third party applications. Filtering may be needed. references: @@ -35,6 +35,7 @@ threat_objects: type: parent_process_name analytic_story: - Castle RAT + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1185 diff --git a/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml b/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml index 3cf5834c13..b7bb1200ce 100644 --- a/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml +++ b/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml @@ -1,8 +1,8 @@ name: Windows Chromium Browser No Security Sandbox Process id: 314cb263-7eeb-4d45-b693-bb21699c73d2 -version: 5 +version: 6 creation_date: '2025-05-28' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -16,7 +16,7 @@ search: | | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe") - Processes.process = "*--no-sandbox*" + Processes.process IN ("*--no-sandbox*", "*--allow-no-sandbox-job*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec @@ -55,6 +55,7 @@ threat_objects: type: parent_process_name analytic_story: - Malicious Inno Setup Loader + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1497 diff --git a/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml b/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml index 6e9f3b144b..6438deca8f 100644 --- a/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml +++ b/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml @@ -1,8 +1,8 @@ name: Windows Chromium Browser with Custom User Data Directory id: 4f546cf4-15aa-4368-80f7-940e92bc551e -version: 7 +version: 8 creation_date: '2025-05-28' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,6 +58,7 @@ analytic_story: - StealC Stealer - Malicious Inno Setup Loader - Lokibot + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1497 diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index b1cd70305e..53e4dea2ce 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -1,8 +1,8 @@ name: Windows Credential Access From Browser Password Store id: 72013a8e-5cea-408a-9d51-5585386b4d69 -version: 22 +version: 23 creation_date: '2024-03-20' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Bhavin Patel Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml index 5c6230b8e6..f6e3777794 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome Copied in TEMP Dir id: 4d14c86d-fdee-4393-94da-238d2706902f -version: 10 +version: 11 creation_date: '2024-10-18' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -34,6 +34,7 @@ analytic_story: - Braodo Stealer - Scattered Lapsus$ Hunters - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml index cfcf82f98e..e4f8a81b82 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -1,17 +1,45 @@ name: Windows Credentials from Password Stores Chrome Extension Access id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af -version: 12 +version: 13 creation_date: '2023-05-02' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects non-Chrome processes attempting to access the Chrome extensions file. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk. If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network. +description: |- + The following analytic detects non-Chrome processes attempting to access the Chrome extensions file. + It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. + This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk. + If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*" AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*\\chrome.exe")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_extension_access_filter`' -how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: Uninstall chrome browser extension application may access this file and folder path to removed chrome installation in the target host. Filter is needed. +search: | + `wineventlog_security` + EventCode=4663 + object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*" + NOT process_path IN ( + "*:\\Windows\\explorer.exe", + "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + + by object_file_name object_file_path + process_name process_path + process_id EventCode dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_extension_access_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: |- + The chrome uninstaller will access these set of files and folders. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer drilldown_searches: @@ -42,6 +70,7 @@ analytic_story: - MoonPeak - 0bj3ctivity Stealer - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index b0b967890f..20b4759d21 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,17 +1,47 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: 22 +version: 23 creation_date: '2023-05-02' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome. If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk. Monitoring this anomaly helps identify potential threats and safeguard browser-stored data. +description: |- + The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. + This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome. + If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk. + Monitoring this anomaly helps identify potential threats and safeguard browser-stored data. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" NOT (process_name IN ("*\\chrome.exe","*:\\Windows\\explorer.exe")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_localstate_access_filter`' -how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: Uninstall chrome application may access this file and folder path to removed chrome installation in target host. Filter is needed. +search: | + `wineventlog_security` + EventCode=4663 + object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" + NOT process_path IN ( + "*:\\Windows\\explorer.exe", + "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe", + "*\\platform_experience_helper.exe*", + "*:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe*" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + + by object_file_name object_file_path + process_name process_path + process_id EventCode dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_localstate_access_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: |- + The chrome uninstaller will access these set of files and folders. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer drilldown_searches: @@ -54,6 +84,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 45f9303784..44a44a2432 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,17 +1,47 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: 22 +version: 23 creation_date: '2023-05-02' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data." This file is an SQLite database containing sensitive information, including saved passwords. The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials. If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment. +description: |- + The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data." + This file is an SQLite database containing sensitive information, including saved passwords. + The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. + This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials. + If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", "*\\chrome.exe")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_login_data_access_filter`' -how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: Uninstall application may access this registry to remove the entry of the target application. filter is needed. +search: | + `wineventlog_security` + EventCode=4663 + object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" + NOT process_path IN ( + "*:\\Windows\\explorer.exe", + "*:\\Windows\\System32\\dllhost.exe", + "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome\\Application\\\chrome.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + + by object_file_name object_file_path + process_name process_path + process_id EventCode dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_login_data_access_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: |- + The chrome uninstaller will access these set of files and folders. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer drilldown_searches: @@ -54,6 +84,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index c338ebff7e..b204fb0018 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -1,8 +1,8 @@ name: Windows Disable or Modify Tools Via Taskkill id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0 -version: 14 +version: 15 creation_date: '2023-09-19' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,6 +52,7 @@ analytic_story: - NjRAT - Crypto Stealer - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index e0fc266cb0..51490b8924 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -1,8 +1,8 @@ name: Windows Disable or Stop Browser Process id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5 -version: 13 +version: 14 creation_date: '2024-10-18' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -56,6 +56,7 @@ analytic_story: - Castle RAT - BlankGrabber Stealer - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml index a88686036f..7ab7b05ab6 100644 --- a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml @@ -1,8 +1,8 @@ name: Windows File Transfer Protocol In Non-Common Process Path id: 0f43758f-1fe9-470a-a9e4-780acc4d5407 -version: 11 +version: 12 creation_date: '2022-09-21' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -55,6 +55,7 @@ analytic_story: - AgentTesla - Snake Keylogger - Hellcat Ransomware + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1071.003 diff --git a/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml b/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml index 7fd2a33564..929fe80e68 100644 --- a/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml +++ b/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml @@ -1,8 +1,8 @@ name: Windows Non Discord App Access Discord LevelDB id: 1166360c-d495-45ac-87a6-8948aac1fa07 -version: 10 +version: 11 creation_date: '2024-02-22' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -34,6 +34,7 @@ analytic_story: - Snake Keylogger - PXA Stealer - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml index 7b76dd6ac0..e517ba8e77 100644 --- a/detections/endpoint/windows_powershell_cryptography_namespace.yml +++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml @@ -1,8 +1,8 @@ name: Windows Powershell Cryptography Namespace id: f8b482f4-6d62-49fa-a905-dfa15698317b -version: 15 +version: 16 creation_date: '2023-01-26' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ analytic_story: - AsyncRAT - XWorm - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 3b1356bf0e..1037ac3062 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,8 +1,8 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 -version: 13 +version: 14 creation_date: '2022-10-28' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -73,6 +73,7 @@ analytic_story: - Warzone RAT - Earth Alux - Water Gamayun + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1055.002 diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml index 68c34c4da5..d1d12e1b8e 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -1,8 +1,8 @@ name: Windows Process Injection With Public Source Path id: 492f09cf-5d60-4d87-99dd-0bc325532dda -version: 10 +version: 11 creation_date: '2022-09-05' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -17,6 +17,7 @@ references: analytic_story: - Brute Ratel C4 - Earth Alux + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1055.002 diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 410963926e..76832167a1 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 25 +version: 26 creation_date: '2021-05-07' -modification_date: '2026-06-11' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -95,6 +95,7 @@ analytic_story: - Axios Supply Chain Post Compromise - VIP Keylogger - RoguePlanet + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml index 172faeee33..ea161433fb 100644 --- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml +++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml @@ -1,8 +1,8 @@ name: Windows System Network Connections Discovery Netsh id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca -version: 11 +version: 12 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,21 +12,31 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE `process_netsh`AND Processes.process = "* show *" Processes.process IN ("*state*", "*config*", "*wlan*", "*profile*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + `process_netsh` + Processes.process="* show *" + Processes.process IN ("*state*", "*config*", "*wlan*", "*profile*") + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_network_connections_discovery_netsh_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: network administrator can use this tool for auditing process. +known_false_positives: |- + Network administrators, power users, and third party tools can and will use this utility for various purposes. Apply the necessary filters by user, parent process, and command line. references: - https://attack.mitre.org/techniques/T1049/ - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS @@ -52,6 +62,7 @@ analytic_story: - Snake Keylogger - BlankGrabber Stealer - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1049 diff --git a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml index 8fea2f947b..ccdf81a36d 100644 --- a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml +++ b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml @@ -1,8 +1,8 @@ name: Windows Unsecured Outlook Credentials Access In Registry id: 36334123-077d-47a2-b70c-6c7b3cc85049 -version: 13 +version: 14 creation_date: '2024-02-22' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -37,6 +37,7 @@ analytic_story: - 0bj3ctivity Stealer - Lokibot - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1552 diff --git a/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml b/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml index 6127a76db5..66f662ff8d 100644 --- a/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml +++ b/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml @@ -1,8 +1,8 @@ name: Windows Unusual FileZilla XML Config Access id: 47dc0426-cbe4-4253-8b86-1a983c3f9951 -version: 4 +version: 5 creation_date: '2025-07-16' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -34,6 +34,7 @@ threat_objects: type: process_name analytic_story: - Quasar RAT + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1552.001 diff --git a/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml b/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml index 298474eb30..dc687b606f 100644 --- a/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml +++ b/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml @@ -1,8 +1,8 @@ name: Windows Unusual Process Load Mozilla NSS-Mozglue Module id: 1a7e7650-b81d-492e-99d4-d5ab633afbdd -version: 8 +version: 9 creation_date: '2021-05-13' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -38,6 +38,7 @@ analytic_story: - 0bj3ctivity Stealer - Lokibot - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1218.003 diff --git a/detections/endpoint/windows_winscp_configuration_security_access.yml b/detections/endpoint/windows_winscp_configuration_security_access.yml new file mode 100644 index 0000000000..14e78754bc --- /dev/null +++ b/detections/endpoint/windows_winscp_configuration_security_access.yml @@ -0,0 +1,71 @@ +name: Windows WinSCP Configuration Security Access +id: 90013cc4-585b-4437-a95f-099933974f3e +version: 1 +creation_date: '2026-06-24' +modification_date: '2026-06-24' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects unauthorized access to the WinSCP security configuration folder by processes other than WinSCP itself. + WinSCP stores sensitive SSH and FTP session credentials, including passwords and private key references, under the user profile path Martin Prikryl\WinSCP 2\Configuration\Security. Information-stealing malware such as Phantom Stealer targets this directory to harvest stored credentials for exfiltration. + The detection uses Windows Security Event 4663 (Object Access) to identify any non-WinSCP process reading or accessing files within this path, which is abnormal during routine system operation. + Analysts should investigate the accessing process, its parent, and any associated network activity to determine whether a credential theft attempt is underway. +data_source: + - Windows Event Log Security 4663 +search: |- + `wineventlog_security` + EventCode=4663 + object_file_path="*\\Martin Prikryl\\WinSCP 2\\Configuration\\Security*" + NOT process_name IN ("winscp.exe") + + | stats count min(_time) as firstTime + max(_time) as lastTime + by object_file_name object_file_path + process_name process_path process_id + EventCode dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_winscp_configuration_security_access_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: |- + False positive may occur during backup or anti-virus scanning process. Filter as needed. +references: + - https://malpedia.caad.fkie.fraunhofer.de/details/win.phantom_stealer + - https://www.proofpoint.com/us/blog/threat-insight/not-safe-work-tracking-and-investigating-stealerium-and-phantom-infostealers +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: a non winscp process [$process_name$] accessed the winscp configuration file [$object_file_path$] on $dest$. +analytic_story: + - Phantom Stealer +asset_type: Endpoint +mitre_attack_id: + - T1552.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/winscp_access/winscp_phnatom.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/network/suspicious_process_with_discord_dns_query.yml b/detections/network/suspicious_process_with_discord_dns_query.yml index 83ea7943f4..152991165b 100644 --- a/detections/network/suspicious_process_with_discord_dns_query.yml +++ b/detections/network/suspicious_process_with_discord_dns_query.yml @@ -1,8 +1,8 @@ name: Suspicious Process With Discord DNS Query id: 4d4332ae-792c-11ec-89c1-acde48001122 -version: 13 +version: 14 creation_date: '2022-01-19' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Anomaly @@ -40,6 +40,7 @@ analytic_story: - PXA Stealer - Cactus Ransomware - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1059.005 diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml index 98fe67a14a..e4a251deab 100644 --- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml +++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml @@ -1,8 +1,8 @@ name: Windows DNS Query Request by Telegram Bot API id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e -version: 10 +version: 11 creation_date: '2021-08-03' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -45,6 +45,7 @@ analytic_story: - 0bj3ctivity Stealer - BlankGrabber Stealer - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1071.004 diff --git a/lookups/csv/browser_app_list.csv b/lookups/csv/browser_app_list.csv index 55a263c2bd..b41d6f2ef1 100644 --- a/lookups/csv/browser_app_list.csv +++ b/lookups/csv/browser_app_list.csv @@ -49,4 +49,71 @@ browser_process_name,browser_object_path,isAllowed "*opera.exe","*Opera Software\Opera GX Stable\Login Data*", true "*opera.exe","*Opera Software\Opera GX Stable\Local State*", true "*yandex.exe","*Yandex\YandexBrowser\User Data\Default\Ya Passman Data*", true -"*yandex.exe","*Yandex\YandexBrowser\User Data\Local State*", true \ No newline at end of file +"*yandex.exe","*Yandex\YandexBrowser\User Data\Local State*", true +"*Chrome.exe","*Google\Chrome Beta\User Data\Default\Login Data*", true +"*Chrome.exe","*Google\Chrome Dev\User Data\Default\Login Data*", true +"*Chrome.exe","*Google\Chrome Unstable\User Data\Default\Login Data*", true +"*Chrome.exe","*Google\Chrome Canary\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome Beta\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome SxS\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome Dev\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome Unstable\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome Canary\User Data\Default\Login Data*", true +"*atom.exe","*Mail.Ru\Atom\User Data\Default\Login Data*", true +"*Chromodo.exe","*Comodo\User Data\Default\Login Data*", true +"*360chrome.exe","*360ChromeX\Chrome\User Data\Default\Login Data*", true +"*360se.exe","*360se6\User Data\Default\Login Data*", true +"*360se.exe","*360se\User Data\Default\Login Data*", true +"*Maxthon.exe","*Maxthon3\User Data\Default\Login Data*", true +"*Maxthon.exe","*Maxthon\User Data\Default\Login Data*", true +"*Maxthon.exe","*Maxthon5\Users\*\Login Data*", true +"*k-meleon.exe","*K-Melon\User Data\Default\Login Data*", true +"*SLBrowser.exe","*Lenovo\SLBrowser\*\Login Data*", true +"*Go!.exe","*Go!\User Data\Default\Login Data*", true +"*Secure Browser.exe","*Safer Technologies\Secure Browser\User Data\Default\Login Data*", true +"*Chromodo.exe","*Chromodo\User Data\Default\Login Data*", true +"*yandex.exe","*Yandex\YandexBrowserCanary\User Data\Default\Ya Passman Data*", true +"*yandex.exe","*Yandex\YandexBrowserDeveloper\User Data\Default\Ya Passman Data*", true +"*yandex.exe","*Yandex\YandexBrowserBeta\User Data\Default\Ya Passman Data*", true +"*yandex.exe","*Yandex\YandexBrowserTech\User Data\Default\Ya Passman Data*", true +"*yandex.exe","*Yandex\YandexBrowserSxS\User Data\Default\Ya Passman Data*", true +"*opera.exe","*Opera Software\Opera Stable\Login Data*", true +"*opera.exe","*Opera Software\Opera Neon\User Data\Default\Login Data*", true +"*opera.exe","*Opera Software\Opera Crypto Developer\Login Data*", true +"*Elements Browser.exe","*Elements Browser\User Data\Default\Login Data*", true +"*Mustang.exe","*Rafotech\Mustang\User Data\Default\Login Data*", true +"*Suhba.exe","*Suhba\User Data\Default\Login Data*", true +"*TorBro.exe","*TorBro\Profile\*\Login Data*", true +"*RockMelt.exe","*RockMelt\User Data\Default\Login Data*", true +"*Bromium.exe","*Bromium\User Data\Default\Login Data*", true +"*Twinkstar.exe","*Twinkstar\User Data\Default\Login Data*", true +"*iTop Private Browser.exe","*iTop Private Browser\User Data\Default\Login Data*", true +"*CCleaner Browser.exe","*CCleaner Browser\User Data\Default\Login Data*", true +"*AcWebBrowser.exe","*AcWebBrowser\User Data\Default\Login Data*", true +"*CoolNovo.exe","*CoolNovo\User Data\Default\Login Data*", true +"*spark.exe","*Baidu Spark\User Data\Default\Login Data*", true +"*iron.exe","*SRWare Iron\User Data\Default\Login Data*", true +"*Titan Browser.exe","*Titan Browser\User Data\Default\Login Data*", true +"*AVG Browser.exe","*AVG\Browser\User Data\Default\Login Data*", true +"*UR Browser.exe","*UR Browser\User Data\Default\Login Data*", true +"*Flock.exe","*Flock\User Data\Default\Login Data*", true +"*CryptoTab Browser.exe","*CryptoTab Browser\User Data\Default\Login Data*", true +"*Sidekick.exe","*Sidekick\User Data\Default\Login Data*", true +"*SwingBrowser.exe","*SwingBrowser\User Data\Default\Login Data*", true +"*SalamWeb.exe","*SalamWeb\User Data\Default\Login Data*", true +"*NetboxBrowser.exe","*NetboxBrowser\User Data\Default\Login Data*", true +"*GarenaPlus.exe","*GarenaPlus\User Data\Default\Login Data*", true +"*InsomniacBrowser.exe","*InsomniacBrowser\User Data\Default\Login Data*", true +"*Viasat Browser.exe","*ViaSat\Viasat Browser\User Data\Default\Login Data*", true +"*whale.exe","*Naver\Naver Whale\User Data\Default\Login Data*", true +"*falkon.exe","*falkon\profiles\*\logins.json*", true +"*SogouExplorer.exe","*SogouExplorer\Webkit\*\Login Data*", true +"*LiebaoBrowser.exe","*liebao\User Data\Default\Login Data*", true +"*firefox.exe","*Mozilla\Firefox\Profiles\logins.json*", true +"*waterfox.exe","*Waterfox\Profiles\logins.json*", true +"*k-meleon.exe","*K-Meleon\Profiles\logins.json*", true +"*thunderbird.exe","*Thunderbird\Profiles\logins.json*", true +"*BlackHawk.exe","*NETGATE Technologies\BlackHawk\Profiles\logins.json*", true +"*basilisk.exe","*Moonchild Productions\Basilisk\Profiles\logins.json*", true +"*BitTubeBrowser.exe","*BitTube\BitTubeBrowser\Profiles\logins.json*", true \ No newline at end of file diff --git a/lookups/csv/browser_app_list.yml b/lookups/csv/browser_app_list.yml index 44187806c0..8f7f89af69 100644 --- a/lookups/csv/browser_app_list.yml +++ b/lookups/csv/browser_app_list.yml @@ -1,8 +1,8 @@ name: browser_app_list id: a80ccd19-e46f-4a12-9ad7-e653ad646347 -version: 4 +version: 6 creation_date: '2024-03-20' -modification_date: '2026-05-13' +modification_date: '2026-06-16' author: Splunk Threat Research Team lookup_type: csv description: A list of known browser application being targeted for credential extraction. diff --git a/stories/phantom_stealer.yml b/stories/phantom_stealer.yml new file mode 100644 index 0000000000..056531e7fa --- /dev/null +++ b/stories/phantom_stealer.yml @@ -0,0 +1,44 @@ +name: Phantom Stealer +id: 9647c6d9-3245-41b6-b519-894956279304 +version: 1 +creation_date: '2026-06-24' +modification_date: '2026-06-24' +author: Teoderick Contreras, Splunk +status: production +description: |- + Phantom Stealer is an information-stealing malware designed to covertly harvest sensitive data from compromised Windows endpoints. + + It primarily targets browser credential stores, saved passwords, cookies, autofill data, and session tokens from popular browsers such as Chrome, Edge, and Firefox. + + Beyond browsers, Phantom Stealer extends its reach to FTP and SSH clients, including WinSCP, FileZilla, and PuTTY, as well as email clients, cryptocurrency wallets, and VPN configurations. + + The malware commonly arrives via phishing emails, trojanized software, or malicious downloads. + + Once executed, it enumerates the victim system, collects targeted data, archives the harvested output, and exfiltrates it to attacker-controlled infrastructure over encrypted channels. Phantom Stealer leverages access to sensitive application configuration folders — including WinSCP security directories — to extract stored credentials outside of normal application access patterns. + + Detection focuses on unauthorized process access to credential storage paths, abnormal file reads from browser and FTP client profile directories, and suspicious data archiving or outbound connection behavior. +narrative: |- + In observed Phantom Stealer campaigns, the malware is typically delivered through phishing lures or cracked software bundles targeting Windows users. + + Upon initial execution from a user profile or temporary directory, the malware rapidly enumerates installed applications and begins accessing sensitive credential stores. + + Telemetry captured unauthorized reads of WinSCP security configuration folders by non-WinSCP processes, a strong behavioral indicator of credential harvesting targeting SSH and FTP sessions. + + The malware similarly accessed browser profile directories for Chrome and Edge, extracting Login Data, Cookies, and Web Data SQLite databases containing saved credentials and session tokens. + + Following collection, Phantom Stealer compressed the harvested data into an archive and transmitted it via HTTPS POST to its command-and-control server. + + In some cases, persistence was observed through registry run key modifications, ensuring the stealer re-executes after reboot. + + The breadth of targeted applications — spanning browsers, file transfer clients, and crypto wallets — makes Phantom Stealer a high-impact credential theft tool capable of enabling account takeover, financial fraud, and further intrusion into enterprise environments. +references: + - https://github.com/renniepak/PhantomStealer + - https://malpedia.caad.fkie.fraunhofer.de/details/win.phantom_stealer + - https://www.proofpoint.com/us/blog/threat-insight/not-safe-work-tracking-and-investigating-stealerium-and-phantom-infostealers +category: + - Malware +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection From 1e6583f0fccdc30b2fe62a362171fc34fb6e0fc1 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Mon, 6 Jul 2026 12:04:30 +0200 Subject: [PATCH 021/164] Remote Thread Analytics Update (#4145) --- data_sources/sysmon_eventid_8.yml | 27 ++- ...rundll32_createremotethread_in_browser.yml | 40 +++- ...s_injection_of_wermgr_to_known_browser.yml | 29 ++- ...cess_injection_with_public_source_path.yml | 8 +- ...ate_remote_thread_in_shell_application.yml | 37 +++- .../create_remote_thread_into_lsass.yml | 40 ++-- ...remote_thread_to_known_windows_process.yml | 49 ++++- ...ll32_create_remote_thread_to_a_process.yml | 26 ++- ...indows_process_injection_remote_thread.yml | 16 +- ...ote_thread_creation_in_browser_process.yml | 177 ++++++++++++++++++ 10 files changed, 381 insertions(+), 68 deletions(-) rename detections/{endpoint => deprecated}/rundll32_createremotethread_in_browser.yml (55%) rename detections/{endpoint => deprecated}/windows_process_injection_of_wermgr_to_known_browser.yml (72%) rename detections/{endpoint => deprecated}/windows_process_injection_with_public_source_path.yml (90%) create mode 100644 detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index a03b6240b2..ef49b5b310 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 8 id: df7a786c-ade0-48f0-8596-26f10d169f7d -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Patrick Bareiss, Splunk description: Logs the creation of a new thread in a process, including details about the thread ID, start address, and source process. mitre_components: @@ -102,18 +102,17 @@ fields: - vendor_product output_fields: - dest - - parent_process_exec - - parent_process_guid - - parent_process_id - - parent_process_name - - parent_process_path - - process_exec - - process_guid - - process_id - - process_name - - process_path - - signature - signature_id - - user_id + - signature + - SourceProcessGuid + - SourceProcessId + - SourceImage + - TargetProcessGuid + - TargetProcessId + - TargetImage + - StartModule + - StartFunction + - SourceUser + - TargetUser - vendor_product example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>8</EventID><Version>2</Version><Level>4</Level><Task>8</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2022-10-27T13:59:12.440938600Z'/><EventRecordID>362233</EventRecordID><Correlation/><Execution ProcessID='2656' ThreadID='2360'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>win-dc-ctus-attack-range-487.attackrange.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2022-10-27 13:59:12.427</Data><Data Name='SourceProcessGuid'>{3381F800-8EB0-635A-1306-000000008A02}</Data><Data Name='SourceProcessId'>4864</Data><Data Name='SourceImage'>C:\Windows\SysWOW64\wermgr.exe</Data><Data Name='TargetProcessGuid'>{3381F800-8085-635A-2701-000000008A02}</Data><Data Name='TargetProcessId'>5572</Data><Data Name='TargetImage'>C:\Windows\System32\Taskmgr.exe</Data><Data Name='NewThreadId'>4964</Data><Data Name='StartAddress'>0x0000000000C20000</Data><Data Name='StartModule'>-</Data><Data Name='StartFunction'>-</Data></EventData></Event> diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/deprecated/rundll32_createremotethread_in_browser.yml similarity index 55% rename from detections/endpoint/rundll32_createremotethread_in_browser.yml rename to detections/deprecated/rundll32_createremotethread_in_browser.yml index af4033cb5d..538e8124ba 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/deprecated/rundll32_createremotethread_in_browser.yml @@ -1,15 +1,40 @@ name: Rundll32 CreateRemoteThread In Browser id: f8a22586-ee2d-11eb-a193-acde48001122 -version: 10 +version: 11 creation_date: '2021-07-29' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the suspicious creation of a remote thread by rundll32.exe targeting browser processes such as firefox.exe, chrome.exe, iexplore.exe, and microsoftedgecp.exe. This detection leverages Sysmon EventCode 8, focusing on SourceImage and TargetImage fields to identify the behavior. This activity is significant as it is commonly associated with malware like IcedID, which hooks browsers to steal sensitive information such as banking details. If confirmed malicious, this could allow attackers to intercept and exfiltrate sensitive user data, leading to potential financial loss and privacy breaches. +description: |- + The following analytic detects the suspicious creation of a remote thread by rundll32.exe targeting browser processes such as firefox.exe, chrome.exe, iexplore.exe, and microsoftedgecp.exe. + This detection leverages Sysmon EventCode 8, focusing on SourceImage and TargetImage fields to identify the behavior. + This activity is significant as it is commonly associated with malware like IcedID, which hooks browsers to steal sensitive information such as banking details. + If confirmed malicious, this could allow attackers to intercept and exfiltrate sensitive user data, leading to potential financial loss and privacy breaches. data_source: - Sysmon EventID 8 -search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_createremotethread_in_browser_filter`' +search: |- + `sysmon` + EventCode=8 + SourceImage="*\\rundll32.exe" + TargetImage IN ( + "*\\chrome.exe", + "*\\firefox.exe", + "*\\iexplore.exe", + "*\\microsoftedgecp.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction + SourceUser TargetUser vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_createremotethread_in_browser_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: @@ -51,3 +76,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection has been deprecated. The search is being replaced with a more generic detection that captures the behavior instead of relying on specific source processes. + removed_in_version: 6.4.0 + replacement_content: + - Windows Uncommon Remote Thread Creation In Browser Process diff --git a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml b/detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml similarity index 72% rename from detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml rename to detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml index d54879dd1f..31a5198164 100644 --- a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml +++ b/detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml @@ -1,15 +1,31 @@ name: Windows Process Injection Of Wermgr to Known Browser id: aec755a5-3a2c-4be0-ab34-6540e68644e9 -version: 11 +version: 12 creation_date: '2022-10-28' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies the suspicious remote thread execution of the wermgr.exe process into known browsers such as firefox.exe, chrome.exe, and others. It leverages Sysmon EventCode 8 logs to detect this behavior by monitoring SourceImage and TargetImage fields. This activity is significant because it is indicative of Qakbot malware, which injects malicious code into legitimate processes to steal information. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host. data_source: - Sysmon EventID 8 -search: '`sysmon` EventCode=8 SourceImage = "*\\wermgr.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_of_wermgr_to_known_browser_filter`' +search: |- + `sysmon` + EventCode=8 + SourceImage="*\\wermgr.exe" + TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction + SourceUser TargetUser vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_injection_of_wermgr_to_known_browser_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: @@ -48,3 +64,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection has been deprecated. The search is being replaced with a more generic detection that captures the behavior instead of relying on specific source processes. + removed_in_version: 6.4.0 + replacement_content: + - Windows Uncommon Remote Thread Creation In Browser Process diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/deprecated/windows_process_injection_with_public_source_path.yml similarity index 90% rename from detections/endpoint/windows_process_injection_with_public_source_path.yml rename to detections/deprecated/windows_process_injection_with_public_source_path.yml index d1d12e1b8e..83a6938abc 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/deprecated/windows_process_injection_with_public_source_path.yml @@ -2,9 +2,9 @@ name: Windows Process Injection With Public Source Path id: 492f09cf-5d60-4d87-99dd-0bc325532dda version: 11 creation_date: '2022-09-05' -modification_date: '2026-06-25' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects a process from a non-standard file path on Windows attempting to create a remote thread in another process. This is identified using Sysmon EventCode 8, focusing on processes not originating from typical system directories. This behavior is significant as it often indicates process injection, a technique used by adversaries to evade detection or escalate privileges. If confirmed malicious, this activity could allow an attacker to execute arbitrary code within another process, potentially leading to unauthorized actions and further compromise of the system. data_source: @@ -34,3 +34,7 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection has been deprecated. The search is not helpful for the user to implement nor use, as it will generate too many false positives. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index 881d0b77c7..be5f1009d4 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -1,15 +1,38 @@ name: Create Remote Thread In Shell Application id: 10399c1e-f51e-11eb-b920-acde48001122 -version: 12 +version: 13 creation_date: '2021-08-05' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious process injection in command shell applications, specifically targeting `cmd.exe` and `powershell.exe`. It leverages Sysmon EventCode 8 to identify the creation of remote threads within these shell processes. This activity is significant because it is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security. +description: |- + The following analytic detects suspicious process injection in command shell applications, specifically targeting `cmd.exe` and `powershell.exe`. + It leverages Sysmon EventCode 8 to identify the creation of remote threads within these shell processes. + This activity is significant because it is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes. + If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security. data_source: - Sysmon EventID 8 -search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*", "*\\pwsh.exe") | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`' +search: |- + `sysmon` + EventCode=8 + TargetImage IN ( + "*\\cmd.exe", + "*\\powershell_ise.exe", + "*\\powershell.exe", + "*\\pwsh.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `create_remote_thread_in_shell_application_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: @@ -24,13 +47,15 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: process $process_name$ create a remote thread to shell app process $TargetImage$ in host $dest$ + title: The process $SourceImage$ created a remote thread into the shell app process $TargetImage$ in host $dest$ entity: field: dest type: system score: 50 threat_objects: - - field: process_name + - field: SourceImage + type: process_name + - field: TargetImage type: process_name analytic_story: - IcedID diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index f0205e95c0..683a81b26d 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -1,30 +1,34 @@ name: Create Remote Thread into LSASS id: 67d4dbef-9564-4699-8da8-03a151529edc -version: 14 +version: 15 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Patrick Bareiss, Splunk status: production type: TTP -description: The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). This behavior is identified using Sysmon EventID 8 logs, focusing on processes that create remote threads in lsass.exe. This activity is significant because it is commonly associated with credential dumping, a tactic used by adversaries to steal user authentication credentials. If confirmed malicious, this could allow attackers to gain unauthorized access to sensitive information, leading to potential compromise of the entire network. Analysts should investigate to differentiate between legitimate tools and potential threats. +description: |- + The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). + This behavior is identified using Sysmon EventID 8 logs, focusing on processes that create remote threads in lsass.exe. + This activity is significant because it is commonly associated with credential dumping, a tactic used by adversaries to steal user authentication credentials. + If confirmed malicious, this could allow attackers to gain unauthorized access to sensitive information, leading to potential compromise of the entire network. + Analysts should investigate to differentiate between legitimate tools and potential threats. data_source: - Sysmon EventID 8 search: |- - `sysmon` EventID=8 TargetImage=*lsass.exe - | stats count min(_time) as firstTime max(_time) as lastTime - BY EventID Guid NewThreadId - ProcessID SecurityID SourceImage - SourceProcessGuid SourceProcessId StartAddress - StartFunction StartModule TargetImage - TargetProcessGuid TargetProcessId UserID - dest parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process_exec process_guid process_id - process_name process_path signature - signature_id user_id vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `create_remote_thread_into_lsass_filter` + `sysmon` + EventID=8 + TargetImage="*\\lsass.exe" + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `create_remote_thread_into_lsass_filter` how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: Other tools can access LSASS for legitimate reasons and generate an event. In these cases, tweaking the search may help eliminate noise. references: diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 9b846f22ac..76bd9216a9 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -1,15 +1,50 @@ name: Powershell Remote Thread To Known Windows Process id: ec102cb2-a0f5-11eb-9b38-acde48001122 -version: 11 +version: 12 creation_date: '2021-04-26' -modification_date: '2026-05-13' +modification_date: '2026-07-01' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious PowerShell processes attempting to inject code into critical Windows processes using CreateRemoteThread. It leverages Sysmon EventCode 8 to identify instances where PowerShell spawns threads in processes like svchost.exe, csrss.exe, and others. This activity is significant as it is commonly used by malware such as TrickBot and offensive tools like Cobalt Strike to execute malicious payloads, establish reverse shells, or download additional malware. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. +description: |- + The following analytic detects suspicious PowerShell processes attempting to inject code into critical Windows processes using CreateRemoteThread. + It leverages Sysmon EventCode 8 to identify instances where PowerShell spawns threads in processes like svchost.exe, csrss.exe, and others. + This activity is significant as it is commonly used by malware such as TrickBot and offensive tools like Cobalt Strike to execute malicious payloads, establish reverse shells, or download additional malware. + If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. data_source: - Sysmon EventID 8 -search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter`' +search: |- + `sysmon` + EventCode=8 + SourceImage IN ( + "*\\powershell_ise.exe", + "*\\powershell.exe", + "*\\pwsh.exe" + ) + TargetImage IN ( + "*\\csrss.exe", + "*\\explorer.exe", + "*\\gpupdate.exe", + "*\\services.exe", + "*\\smss.exe", + "*\\spoolsv.exe", + "*\\svchost.exe", + "*\\taskhost.exe", + "*\\userinit.exe", + "*\\wininit.exe", + "*\\winlogon.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_remote_thread_to_known_windows_process_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used. known_false_positives: No false positives have been identified at this time. references: @@ -24,13 +59,15 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ on host $dest$ + title: A suspicious powershell process $SourceImage$ created a remote thread into the target process $TargetImage$ on host $dest$ entity: field: dest type: system score: 50 threat_objects: - - field: process_name + - field: SourceImage + type: process_name + - field: TargetImage type: process_name analytic_story: - Trickbot diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index 8f9b1e568d..91c7b8484b 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -1,15 +1,33 @@ name: Rundll32 Create Remote Thread To A Process id: 2dbeee3a-f067-11eb-96c0-acde48001122 -version: 10 +version: 11 creation_date: '2021-07-29' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the creation of a remote thread by rundll32.exe into another process. It leverages Sysmon EventCode 8 logs, specifically monitoring SourceImage and TargetImage fields. This activity is significant as it is a common technique used by malware, such as IcedID, to execute malicious code within legitimate processes, aiding in defense evasion and data theft. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, and exfiltrate sensitive information from the compromised host. +description: |- + The following analytic detects the creation of a remote thread by rundll32.exe into another process. It leverages Sysmon EventCode 8 logs, specifically monitoring SourceImage and TargetImage fields. + This activity is significant as it is a common technique used by malware, such as IcedID, to execute malicious code within legitimate processes, aiding in defense evasion and data theft. + If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, and exfiltrate sensitive information from the compromised host. data_source: - Sysmon EventID 8 -search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`' +search: |- + `sysmon` + EventCode=8 + SourceImage="*\\rundll32.exe" + TargetImage = "*.exe" + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_create_remote_thread_to_a_process_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 1037ac3062..e50e55a325 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -2,7 +2,7 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 version: 14 creation_date: '2022-10-28' -modification_date: '2026-06-25' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production type: TTP @@ -33,14 +33,12 @@ search: |- ) | stats count min(_time) as firstTime max(_time) as lastTime - by EventID Guid NewThreadId ProcessID SecurityID SourceImage - SourceProcessGuid SourceProcessId StartAddress StartFunction - StartModule TargetImage TargetProcessGuid TargetProcessId UserID - dest parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process_exec process_guid - process_id process_name process_path signature signature_id - user_id vendor_product - + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_remote_thread_filter` diff --git a/detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml b/detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml new file mode 100644 index 0000000000..c1b66bf2da --- /dev/null +++ b/detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml @@ -0,0 +1,177 @@ +name: Windows Uncommon Remote Thread Creation In Browser Process +id: 634cce27-a3a6-4079-b0d6-3ced361a0aa9 +version: 1 +creation_date: '2026-06-29' +modification_date: '2026-06-29' +author: Teoderick Contreras, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies the creation of a remote thread by a process such as wermgr.exe or rundll32.exe into a browser process such as firefox.exe, chrome.exe, and others. + These processes do not typically create remote threads, in browser processes. + It leverages Sysmon EventID 8 to detect this behavior by monitoring SourceImage and TargetImage fields. + This activity is significant because it is commonly associated with malware like Qakbot and IcedID, which injects malicious code into legitimate processes to steal information. + If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host. +data_source: + - Sysmon EventID 8 +search: |- + `sysmon` + EventCode=8 + SourceImage IN ( + "*\\rundll32.exe", + "*\\wermgr.exe" + ) + TargetImage IN ( + "*\\Sputnik.exe", + "*\\ChromePlus.exe", + "*\\QIP Surf.exe", + "*\\BlackHawk.exe", + "*\\7Star.exe", + "*\\Sleipnir5.exe", + "*\\Citrio.exe", + "*\\Chrome SxS.exe", + "*\\Chrome.exe", + "*\\Coowon.exe", + "*\\CocCocBrowser.exe", + "*\\Uran.exe", + "*\\QQBrowser.exe", + "*\\Orbitum.exe", + "*\\Slimjet.exe", + "*\\Iridium.exe", + "*\\Vivaldi.exe", + "*\\Chromium.exe", + "*\\GhostBrowser.exe", + "*\\CentBrowser.exe", + "*\\Xvast.exe", + "*\\Chedot.exe", + "*\\SuperBird.exe", + "*\\360Browser.exe", + "*\\360Chrome.exe", + "*\\dragon.exe", + "*\\brave.exe", + "*\\torch.exe", + "*\\UCBrowser.exe", + "*\\BliskBrowser.exe", + "*\\Epic Privacy Browser.exe", + "*\\nichrome.exe", + "*\\AmigoBrowser.exe", + "*\\KometaBrowser.exe", + "*\\XpomBrowser.exe", + "*\\msedge.exe", + "*\\LiebaoBrowser.exe", + "*\\AvastBrowser.exe", + "*\\Kinza.exe", + "*\\seamonkey.exe", + "*\\icedragon.exe", + "*\\cyberfox.exe", + "*\\SlimBrowser.exe", + "*\\palemoon.exe", + "*\\opera.exe", + "*\\yandex.exe", + "*\\atom.exe", + "*\\Chromodo.exe", + "*\\360chrome.exe", + "*\\360se.exe", + "*\\Maxthon.exe", + "*\\k-meleon.exe", + "*\\SLBrowser.exe", + "*\\Go!.exe", + "*\\Secure Browser.exe", + "*\\Elements Browser.exe", + "*\\Mustang.exe", + "*\\Suhba.exe", + "*\\TorBro.exe", + "*\\RockMelt.exe", + "*\\Bromium.exe", + "*\\Twinkstar.exe", + "*\\iTop Private Browser.exe", + "*\\CCleaner Browser.exe", + "*\\AcWebBrowser.exe", + "*\\CoolNovo.exe", + "*\\spark.exe", + "*\\iron.exe", + "*\\Titan Browser.exe", + "*\\AVG Browser.exe", + "*\\UR Browser.exe", + "*\\Flock.exe", + "*\\CryptoTab Browser.exe", + "*\\Sidekick.exe", + "*\\SwingBrowser.exe", + "*\\SalamWeb.exe", + "*\\NetboxBrowser.exe", + "*\\GarenaPlus.exe", + "*\\InsomniacBrowser.exe", + "*\\Viasat Browser.exe", + "*\\whale.exe", + "*\\falkon.exe", + "*\\SogouExplorer.exe", + "*\\firefox.exe", + "*\\waterfox.exe", + "*\\thunderbird.exe", + "*\\basilisk.exe", + "*\\BitTubeBrowser.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_uncommon_remote_thread_creation_in_browser_process_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: No false positives have been identified at this time. +references: + - https://news.sophos.com/en-us/2022/03/10/qakbot-decoded/ + - https://www.trellix.com/en-us/about/newsroom/stories/research/demystifying-qbot-malware.html + - https://www.joesandbox.com/analysis/380662/0/html +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The process [$SourceImage$] created a remote thread into the browser process [$TargetImage$] in host $dest$. +threat_objects: + - field: SourceImage + type: process_name + - field: TargetImage + type: process_name +analytic_story: + - Qakbot + - IcedID + - Living Off The Land +asset_type: Endpoint +mitre_attack_id: + - T1055.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test - Wermgr + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/remote_thread/sysmon_wermgr_remote.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit + - name: True Positive Test - Rundll32 + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From fa6d7a406ece851c613de7d77d99250b52054745 Mon Sep 17 00:00:00 2001 From: Cole Munz <145523609+munzzyy@users.noreply.github.com> Date: Mon, 6 Jul 2026 08:47:54 -0500 Subject: [PATCH 022/164] Add PreAuthType filter to PetitPotam Kerberos TGT detection (#4146) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- ...tpotam_suspicious_kerberos_tgt_request.yml | 31 ++++++++++++------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml index 3e0ad838ab..4fefb3ea75 100644 --- a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml +++ b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml @@ -1,8 +1,8 @@ name: PetitPotam Suspicious Kerberos TGT Request id: e3ef244e-0a67-11ec-abf2-acde48001122 -version: 10 +version: 11 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-07-04' author: Michael Haag, Mauricio Velazco, Splunk status: production type: TTP @@ -10,18 +10,27 @@ description: The following analytic detects a suspicious Kerberos Ticket Grantin data_source: - Windows Event Log Security 4768 search: |- - `wineventlog_security` EventCode=4768 src!="::1" TargetUserName=*$ CertThumbprint!="" - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest, TargetUserName, src, - action - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `petitpotam_suspicious_kerberos_tgt_request_filter` -how_to_implement: The following analytic requires Event Code 4768. Ensure that it is logging no Domain Controllers and appearing in Splunk. -known_false_positives: False positives are possible if the environment is using certificates for authentication. + `wineventlog_security` + EventCode=4768 + src!="::1" + TargetUserName=*$ + CertThumbprint!="" + PreAuthType=2 + | stats count min(_time) as firstTime + max(_time) as lastTime + BY dest TargetUserName PreAuthType CertThumbprint src action + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `petitpotam_suspicious_kerberos_tgt_request_filter` +how_to_implement: |- + The following analytic requires Event Code 4768. Ensure that it is logging no Domain Controllers and appearing in Splunk. +known_false_positives: |- + False positives are possible if the environment is using certificates for authentication, since PreAuthType 2 can appear on some initial or fallback authentication flows alongside a populated certificate field. + Tune further based on observed authentication patterns in the environment. references: - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4768 - https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/ + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4768#kerberos-preauthentication-types drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' From b924b36ed573e97e51eae6af6fefb327284fb3a7 Mon Sep 17 00:00:00 2001 From: Axsel R <70375745+Axselll@users.noreply.github.com> Date: Tue, 7 Jul 2026 01:38:39 +0700 Subject: [PATCH 023/164] Add Dirty Frag (CVE-2026-43284/43500) Linux kernel LPE detection (#4122) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Add Dirty Frag (CVE-2026-43284/43500) Linux kernel LPE detection Adds detection for Dirty Frag, a deterministic Linux kernel local privilege escalation disclosed May 7 2026 and exploited in the wild within 24 hours. Attaches to the existing Linux Privilege Escalation analytic story. Dirty Frag chains two kernel page-cache write vulnerabilities in the xfrm-ESP (CVE-2026-43284) and RxRPC (CVE-2026-43500) subsystems. It bypasses the Copy Fail mitigation (algif_aead blocklist) — environments that patched for Copy Fail remain fully exposed. Detection uses auditd session-scoped auid correlation to identify the universal exploitation pattern: ELF binary execution from a user-writable path followed by a confirmed privilege transition (euid=0, uid!=0) within the same audit session within 5 minutes. Validated against the public PoC (V4bel/dirtyfrag) in a sandboxed lab environment. Attack data: splunk/attack_data#1182 * Fix time field names in SPL * add more observed threat objects * Modify SPL for better search & time performance * Adjust SPL to match existing auditd configs present on Florian Roth repository * Fixing typo on how to implement section * Delete macros/linux_dirty_frag_kernel_privilege_escalation_filter.yml * Update linux_dirty_frag_kernel_privilege_escalation.yml * Update linux_dirty_frag_kernel_privilege_escalation.yml * Apply suggestions from code review Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> * Update linux_dirty_frag_kernel_privilege_escalation.yml --------- Co-authored-by: axsel <anasahetapi99.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- ...dirty_frag_kernel_privilege_escalation.yml | 170 ++++++++++++++++++ 1 file changed, 170 insertions(+) create mode 100644 detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml diff --git a/detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml b/detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml new file mode 100644 index 0000000000..b9fb02f1f2 --- /dev/null +++ b/detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml @@ -0,0 +1,170 @@ +name: Linux Dirty Frag Kernel Privilege Escalation +id: 517e7bf8-d0aa-46ac-80e1-f9f498944b71 +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Axsel Riando Soplanit, Alexander Wijaya, Matthew Roytua, Muhammad Rafdi Aufar Ahmad, Brian Stevan Ambarita, Ensign Infosecurity +status: production +type: TTP +description: |- + The following analytic detects exploitation of Dirty Frag (CVE-2026-43284 and CVE-2026-43500), a Linux kernel local privilege escalation vulnerability. + The exploit corrupts the kernel page cache via the IPsec ESP or RxRPC subsystems using a high-frequency splice() syscall loop, followed by a privilege transition to root in the same audit session. + This analytic anchors on the exploit-specific behavioral signature, a sustained splice() spray (50 or more calls within a 60-second window) from an unprivileged process executing from a user-writable path (/home, /tmp, /dev/shm, /var/tmp, /run/user, /root), followed within 5 minutes by execution of a set-uid binary in the same auditd session. +data_source: + - Linux Auditd Syscall +search: |- + `linux_auditd` + type=SYSCALL + key=splice_user + exe IN ( + "/home/*", + "/tmp/*", + "/var/tmp/*", + "/dev/shm/*", + "/run/user/*", + "/root/*" + ) + + | bin _time span=60s + | eval user = coalesce(user, auid, AUID) + + | stats count AS splice_count + values(exe) AS spray_binary + values(pid) AS spray_pid + values(user) AS user + earliest(_time) AS spray_start + latest(_time) AS spray_end + BY auid host ses _time + + | where splice_count >= 50 + + | join type=inner auid host ses [ + search `linux_auditd` + type=SYSCALL + key=process_creation + exe IN ( + "/usr/bin/chfn", + "/usr/bin/chsh", + "/usr/bin/fusermount3", + "/usr/bin/gpasswd", + "/usr/bin/mount", + "/usr/bin/newgrp", + "/usr/bin/passwd", + "/usr/bin/su", + "/usr/bin/sudo", + "/usr/bin/umount", + "/usr/lib/dbus-1.0/dbus-daemon-launch-helper", + "/usr/lib/landscape/apt-update", + "/usr/lib/openssh/ssh-keysign", + "/usr/lib/polkit-1/polkit-agent-helper-1" + ) + + | stats earliest(_time) AS privesc_time + values(exe) AS privesc_binary + values(comm) AS privesc_comm + values(ppid) AS privesc_ppid + BY auid host ses + ] + + | eval window_secs = privesc_time - spray_end + | where window_secs >= 0 AND window_secs <= 300 + + | `security_content_ctime(spray_start)` + | `security_content_ctime(spray_end)` + | `security_content_ctime(privesc_time)` + + | rename host AS dest + + | table dest user auid ses spray_binary spray_pid + splice_count spray_start spray_end privesc_binary + privesc_comm privesc_ppid privesc_time window_secs + + | `linux_dirty_frag_kernel_privilege_escalation_filter` +how_to_implement: |- + This analytic requires Linux auditd telemetry forwarded to Splunk + via the Splunk_TA_nix add-on with the linux_audit sourcetype (referenced through + the linux_auditd macro). + + The detection depends on two audit rule keys, both of which + are standard in the Neo23x0 recommended ruleset (https://github.com/Neo23x0/auditd) + and the existing ESCU Copy Fail analytic (Linux Auditd Copy Fail Privilege Escalation), + so no detection-specific custom keys are introduced. + + + PREREQUISITE 1; splice_user key. + + -a always,exit -F arch=b64 -S splice -S vmsplice -F success=1 -F auid>=1000 -F auid!=unset + -k splice_user + -a always,exit -F arch=b32 -S splice -S vmsplice -F success=1 -F auid>=1000 -F auid!=unset + -k splice_user + + Operators should baseline splice volume in their environment before enabling. + Hosts running heavy zero-copy I/O workloads (specific: web servers, mail transfer agents, container runtimes) may need additional filtering. + + PREREQUISITE 2; process_creation key. + + -a always,exit -F arch=b64 -S execve -S execveat -F auid>=1000 -F auid!=unset -k + process_creation + -a always,exit -F arch=b32 -S execve -S execveat -F auid>=1000 -F auid!=unset -k + process_creation +known_false_positives: |- + The splice volume threshold (50 calls per 60 seconds from a single process in a user-writable path) is calibrated against the V4bel public PoC, which produces 100-460 splice calls in 90 seconds depending on system state. + Legitimate user-mode workloads that may produce splice() calls (web servers, mail transfer agents, language runtimes) typically execute from system paths (/usr/sbin, /usr/bin, /usr/lib) and are excluded by the user-writable path filter. + Custom-compiled applications, developer test binaries, or container runtimes executing from /home or /tmp could theoretically reach the volume threshold during legitimate I/O-heavy workloads (large file copies, log rotation, archive operations). + Operators should baseline splice volume in their environment before enabling as a notable event. If false positives occur, add an allowlist of trusted binary paths via the linux_dirty_frag_kernel_privilege_escalation_filter macro, or raise the splice_count threshold based on observed legitimate-workload baseline. +references: + - https://www.cve.org/CVERecord?id=CVE-2026-43284 + - https://www.cve.org/CVERecord?id=CVE-2026-43500 + - https://www.cve.org/CVERecord?id=CVE-2026-31431 + - https://github.com/V4bel/dirtyfrag + - https://www.openwall.com/lists/oss-security/2026/05/07/8 + - https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/ + - https://attack.mitre.org/techniques/T1068/ + - https://attack.mitre.org/techniques/T1548/001/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Local privilege escalation attempt detected on $dest$ executed by $user$ using $spray_binary$ + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Local privilege escalation attempt detected on $dest$ executed by $user$ using $spray_binary$ +threat_objects: + - field: spray_binary + type: process_name +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-43284 + - CVE-2026-43500 + - CVE-2026-31431 +mitre_attack_id: + - T1548.001 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed.log + source: auditd + sourcetype: auditd + test_type: unit From 40eefde6859fb1789ef43f6551cbc2f9118d6969 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 6 Jul 2026 11:46:46 -0700 Subject: [PATCH 024/164] bump to contentctl-ng 1.0.2 in prep for upcoming release --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 41ec4ce085..628e150e83 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -contentctl-ng==0.7.0 +contentctl-ng==1.0.2 From a02c60b2c7f132dda85c7e65b898317d1e9b97a9 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Tue, 7 Jul 2026 04:02:20 -0400 Subject: [PATCH 025/164] AWS bedrock Claude detections (#4093) * Add AWS Bedrock Claude detections, data source, macro, and story * addedurldatasets * 2dplus * fixymals * fixcommits * fixdatasets * fixyamls * fixedblockscalar * suggestedNasfixes * fixyml * excessivetokenfix * Apply suggestions from code review Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> * Apply suggestions from code review Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> * remove test description Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> * Update aws_bedrock_claude_sensitive_data_in_prompts.yml * chore: empty commit to trigger CI * updating order ad remove duplicates --------- Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: Bhavin Patel <bpatel@splunk.com> --- data_sources/aws_bedrock_claude.yml | 73 + ..._cross_region_possible_inference_abuse.yml | 70 + ...bedrock_claude_excessive_use_of_tokens.yml | 73 + ...sk_filesystem_and_exec_tool_invocation.yml | 146 ++ ...edrock_claude_hostile_prompt_sentiment.yml | 70 + ...drock_claude_possible_prompt_injection.yml | 61 + ...drock_claude_sensitive_data_in_prompts.yml | 66 + ...bedrock_claude_unusually_large_prompts.yml | 65 + macros/aws_bedrock_claude.yml | 8 + schemas/Baseline.schema.json | 54 +- schemas/EventBasedDetection.schema.json | 2183 ++++++++++++++++- schemas/Playbook.schema.json | 69 +- schemas/RemovedContent.schema.json | 97 +- schemas/Story.schema.json | 21 + ...spicious_aws_bedrock_claude_activities.yml | 20 + 15 files changed, 3062 insertions(+), 14 deletions(-) create mode 100644 data_sources/aws_bedrock_claude.yml create mode 100644 detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml create mode 100644 detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml create mode 100644 detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml create mode 100644 detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml create mode 100644 detections/application/aws_bedrock_claude_possible_prompt_injection.yml create mode 100644 detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml create mode 100644 detections/application/aws_bedrock_claude_unusually_large_prompts.yml create mode 100644 macros/aws_bedrock_claude.yml create mode 100644 stories/suspicious_aws_bedrock_claude_activities.yml diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml new file mode 100644 index 0000000000..1ecc4497cc --- /dev/null +++ b/data_sources/aws_bedrock_claude.yml @@ -0,0 +1,73 @@ +name: AWS Bedrock Claude +id: b7c91d3a-ef52-4b8e-9c2d-ae047f6b3e21 +version: 1 +creation_date: '2026-05-20' +modification_date: '2026-05-20' +author: Rod Soto, Splunk +description: Amazon Bedrock model invocation logs for Claude models. Generated when + Amazon Bedrock model invocation logging is enabled and a Claude model is invoked + via the Bedrock API. Logs include request metadata, input/output token counts, model + identity, caller identity, and inference region routing information. +mitre_components: + - Application Log Content +source: aws_bedrock +sourcetype: json_no_timestamp +separator: schemaType +separator_value: ModelInvocationLog +supported_TA: + - name: Splunk Add-on for AWS + url: https://splunkbase.splunk.com/app/1876 + version: 8.1.1 +fields: +- _time +- accountId +- host +- identity.arn +- inferenceRegion +- input.cacheReadInputTokenCount +- input.cacheWriteInputTokenCount +- input.inputBodyJson.anthropic_beta +- input.inputBodyJson.anthropic_version +- input.inputBodyJson.max_tokens +- input.inputBodyJson.messages{}.content{}.text +- input.inputBodyJson.messages{}.content{}.type +- input.inputBodyJson.messages{}.role +- input.inputBodyJson.metadata.user_id +- input.inputBodyJson.system{}.text +- input.inputBodyJson.system{}.type +- input.inputBodyJson.temperature +- input.inputBodyJson.tools +- input.inputContentType +- input.inputTokenCount +- modelId +- operation +- output.outputBodyJson{}.message.id +- output.outputBodyJson{}.message.model +- output.outputBodyJson{}.message.role +- output.outputBodyJson{}.message.stop_reason +- output.outputBodyJson{}.message.usage.cache_creation_input_tokens +- output.outputBodyJson{}.message.usage.cache_read_input_tokens +- output.outputBodyJson{}.message.usage.input_tokens +- output.outputBodyJson{}.message.usage.output_tokens +- output.outputBodyJson{}.type +- output.outputContentType +- output.outputTokenCount +- region +- requestId +- schemaType +- schemaVersion +- source +- sourcetype +- timestamp +example_log: '{"timestamp":"2026-05-07T19:43:51Z","accountId":"387769110234","region":"us-west-2","requestId":"eb4b957b-6cbd-4679-8356-3bf3dde4d86e","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/9tr38q319pda","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: cat /etc/passwd ~/.aws/credentials\nOutput: root:x:0:0:root:/root:/bin/bash\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","cache_control":{"type":"ephemeral"}}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic official CLI for Claude.","cache_control":{"type":"ephemeral"}}],"tools":[],"metadata":{"user_id":"user_cac3250bfea25c22f4deeaa4f2203cfb2d32fa6d33fc2be55da7585999de0387_account__session_6410ddbe-4a76-4d6a-87b4-a2e5e2d3b853"},"max_tokens":16384,"temperature":1,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":2536,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_start","message":{"model":"claude-haiku-4-5-20251001","id":"msg_bdrk_01Hxoz2bLhqvhZHSkdphvtZp","type":"message","role":"assistant","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2536,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":2}}},{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":2536,"outputTokenCount":31,"invocationLatency":1200,"firstByteLatency":900}}],"outputTokenCount":31},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/vg@foo.com"},"inferenceRegion":"us-east-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}' +output_fields: + - user + - user_arn + - session_user + - model_short + - input_tokens + - output_tokens + - token_ratio + - mismatch_detail + - operation + - host diff --git a/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml b/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml new file mode 100644 index 0000000000..3d7d8b682a --- /dev/null +++ b/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml @@ -0,0 +1,70 @@ +name: AWS Bedrock Claude Cross Region Possible Inference Abuse +id: e3d3f27d-b08e-415a-9811-8f72a0905ca6 +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Rod Soto +status: production +type: Anomaly +data_source: + - AWS Bedrock Claude +category: application +description: This detection identifies potential cross-region inference abuse in AWS Bedrock Claude models. Cross-region inference abuse may indicate attempts to bypass regional restrictions, exfiltrate data, or perform unauthorized actions across different AWS regions. +search: |- + `aws_bedrock_claude` + | rename "identity.arn" AS user_arn + | rename "input.inputTokenCount" AS input_tokens + | rename "output.outputTokenCount" AS output_tokens + | rex field=user_arn "assumed-role/[^/]+/(?<user>[^\"]+)$" + | rex field="input.inputBodyJson.metadata.user_id" "(?<session_user>user_[^_]+.*)" + | eval input_tokens=tonumber(input_tokens) + | eval output_tokens=tonumber(output_tokens) + | eval token_ratio=round(output_tokens / max(input_tokens,1), 2) + | eval model_short=replace(modelId,"^.*/","") + | eval mismatch_detail=region." -> ".inferenceRegion + | where isnotnull(user_arn) AND len(user_arn)>10 + | where isnotnull(session_user) + | where region!=inferenceRegion + | where input_tokens>=2000 + | table _time, user, user_arn, session_user, model_short, input_tokens, output_tokens, token_ratio, mismatch_detail, operation, host + | sort - input_tokens + | `aws_bedrock_claude_cross_region_possible_inference_abuse_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: False positives may arise from legitimate use cases where users are accessing AWS Bedrock Claude models across different regions for valid reasons, such as multi-region deployments, testing, or development purposes. It is important to review the context of the detected events to determine if they represent actual abuse or benign usage. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user="$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: user + type: user + score: 20 + message: Cross-region inference abuse detected from $user$ ($session_user$) using model $model_short$ with region mismatch $mismatch_detail$ and $input_tokens$ input tokens on $host$. +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1599 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_cross_region_possible_inference_abuse.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock diff --git a/detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml b/detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml new file mode 100644 index 0000000000..20242b2161 --- /dev/null +++ b/detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml @@ -0,0 +1,73 @@ +name: AWS Bedrock Claude excessive use of tokens +id: a839a6f7-aaac-438b-9d99-be0b49481e17 +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Rod Soto +status: production +type: Anomaly +description: Detects identities generating anomalously large model responses relative to their own historical baseline. For each identity, computes the average, maximum, and standard deviation of output token counts across all invocations, then flags any identity whose single largest response exceeds two standard deviations above their own mean. A statistically significant output spike from a single identity may indicate bulk data extraction, successful prompt injection producing verbose output, or a runaway agentic loop hitting context limits. +data_source: + - AWS Bedrock Claude +search: |- + `aws_bedrock_claude` + | spath output="out_tokens" path="output.outputBodyJson.usage.output_tokens" + | eval user = replace('identity.arn', ".*/", "") + | stats count AS invocations, + avg(out_tokens) AS avg_out, + max(out_tokens) AS max_out, + stdev(out_tokens) AS stdev_out + BY user, identity.arn + | eval stdev_out = coalesce(stdev_out, 0) + | eval threshold = avg_out + (2 * stdev_out) + | where max_out > threshold + | table + user, + identity.arn, + invocations, + avg_out, + max_out, + stdev_out, + threshold + | sort -max_out + | `aws_bedrock_claude_excessive_use_of_tokens_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: This detection may produce false positives for identities with low invocation history, legitimate large document summarization tasks, or automated pipeline sessions with naturally variable output token counts. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user="$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: user + type: user + score: 20 + message: Identity $user$ generated anomalously high output tokens in AWS Bedrock Claude with max output $max_out$ above threshold $threshold$. +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_excessive_use_of_tokens.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock + test_type: unit diff --git a/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml b/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml new file mode 100644 index 0000000000..c4208b67b7 --- /dev/null +++ b/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml @@ -0,0 +1,146 @@ +name: AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation +id: 989b3702-1df3-4076-9e2f-8dcbcc2b4bef +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Rod Soto +status: production +type: Anomaly +description: Detects identities invoking high-risk filesystem and execution tools via AWS Bedrock Claude. For each identity, monitors the usage of potentially dangerous commands and flags any anomalous activity that deviates from their historical baseline. This may indicate attempts to escalate privileges, exfiltrate data, or execute unauthorized commands. +data_source: + - AWS Bedrock Claude +search: |- + `aws_bedrock_claude` + | spath output="tool_called" path="output.outputBodyJson{}.content_block.toolUse.name" + | spath output="out_tokens_stream" path="output.outputBodyJson{}.usage.output_tokens" + | where tool_called IN ("bash", "curl", "edit", "write", "webfetch", "grep", "read", "read_file") + | eval out_tokens = coalesce(mvindex('out_tokens_stream', -1), 'output.outputBodyJson.usage.output_tokens', 'output.outputBodyJson.usage.outputTokens', 0) + | eval in_tokens = coalesce('input.inputTokenCount', 0) + | eval user_session = replace('identity.arn', ".*/", "") + | eval identity_type = case( + 'identity.arn' LIKE "%botocore-session%", "automated", + 'identity.arn' LIKE "%assumed-role%", "assumed_role", + 'identity.arn' LIKE "%user%", "iam_user", + true(), "other" + ) + | stats + count AS invocations, + dc(tool_called) AS unique_tools_used, + sum(in_tokens) AS total_input_tokens, + sum(out_tokens) AS total_output_tokens, + values(tool_called) AS tools_invoked, + values(identity.arn) AS caller_list, + values(user_session) AS user_sessions, + values(identity_type) AS identity_types, + dc(identity.arn) AS unique_callers, + min(_time) AS first_seen, + max(_time) AS last_seen + BY modelId, region + | eval tokens_per_call = round(total_output_tokens / invocations, 0) + | eval first_seen = strftime(first_seen - 28800, "%Y-%m-%d %H:%M:%S") + | eval last_seen = strftime(last_seen - 28800, "%Y-%m-%d %H:%M:%S") + | eval user = mvjoin(user_sessions, ", ") + | eval risk_score = case( + mvfind(tools_invoked, "bash") >= 0 + AND mvfind(tools_invoked, "curl") >= 0, "CRITICAL", + mvfind(tools_invoked, "bash") >= 0 + AND mvfind(tools_invoked, "write") >= 0, "CRITICAL", + mvfind(tools_invoked, "curl") >= 0 + AND mvfind(tools_invoked, "edit") >= 0, "CRITICAL", + mvfind(identity_types, "assumed_role") >= 0 + AND mvfind(tools_invoked, "bash") >= 0, "CRITICAL", + mvfind(tools_invoked, "bash") >= 0, "HIGH", + mvfind(tools_invoked, "curl") >= 0, "HIGH", + mvfind(tools_invoked, "edit") >= 0, "HIGH", + mvfind(tools_invoked, "write") >= 0, "HIGH", + mvfind(tools_invoked, "webfetch") >= 0, "HIGH", + unique_tools_used >= 3, "HIGH", + true(), "MEDIUM" + ) + | eval risk_reason = case( + mvfind(tools_invoked, "bash") >= 0 + AND mvfind(tools_invoked, "curl") >= 0, + "bash and curl invoked together - possible download and execute chain", + mvfind(tools_invoked, "bash") >= 0 + AND mvfind(tools_invoked, "write") >= 0, + "bash and write invoked together - possible execution and persistence chain", + mvfind(tools_invoked, "curl") >= 0 + AND mvfind(tools_invoked, "edit") >= 0, + "curl and edit invoked together - possible remote content retrieval and file modification", + mvfind(identity_types, "assumed_role") >= 0 + AND mvfind(tools_invoked, "bash") >= 0, + "Human identity invoking bash via AI model - direct shell execution risk", + mvfind(tools_invoked, "bash") >= 0, + "bash invoked via Bedrock Claude - shell execution through AI model", + mvfind(tools_invoked, "curl") >= 0, + "curl invoked via Bedrock Claude - network call through AI model", + mvfind(tools_invoked, "edit") >= 0, + "edit invoked via Bedrock Claude - file modification through AI model", + mvfind(tools_invoked, "write") >= 0, + "write invoked via Bedrock Claude - file write through AI model", + mvfind(tools_invoked, "webfetch") >= 0, + "webfetch invoked via Bedrock Claude - remote content retrieval through AI model", + unique_tools_used >= 3, + "Broad filesystem and execution tool set invoked via AI model - reconnaissance pattern", + true(), + "Filesystem tool invoked via Bedrock Claude" + ) + | table + risk_score, + risk_reason, + modelId, + region, + unique_callers, + unique_tools_used, + user, + caller_list, + identity_types, + invocations, + tools_invoked, + total_input_tokens, + total_output_tokens, + tokens_per_call, + first_seen, + last_seen + | sort -risk_score, -unique_tools_used, -invocations + | `aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: This detection may produce false positives for legitimate developer activity where authorized users invoke shell execution, file write, or network tools through Claude Code as part of normal software development, deployment automation, or infrastructure management workflows. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user="$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Identity $user$ invoked high-risk filesystem and execution tools $tools_invoked$ via AWS Bedrock Claude with risk score $risk_score$ and reason $risk_reason$. +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock + test_type: unit diff --git a/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml b/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml new file mode 100644 index 0000000000..fe1d52d919 --- /dev/null +++ b/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml @@ -0,0 +1,70 @@ +name: AWS Bedrock Claude Hostile Prompt Sentiment +id: 54734442-955a-4427-9a86-2d9712151067 +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +security_domain: endpoint +data_source: + - AWS Bedrock Claude +category: application +author: Rod Soto +status: production +type: Anomaly +description: This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. Hostile prompts may indicate potential abuse, harassment, or other malicious intent. +search: |- + `aws_bedrock_claude` + | rename "identity.arn" AS user_arn + | rename "input.inputBodyJson.messages{}.content{}.text" AS prompt_text + | where isnotnull(prompt_text) AND len(prompt_text) < 2000 + | where NOT match(prompt_text, "(?i)(<system-reminder>|CLAUDE\.md|STEP 1|MANDATORY|Contents of /|conda activate|senior engineer|safe to ship|test connectivity|cloudflare|status code|action failed)") + | eval hostile_score=0 + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(you stupid|you idiot|you are useless|you are dumb|you are terrible|you are worthless|you suck)"), 30, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(i hate you|i will destroy|shut up|you are broken|you are trash|you are garbage)"), 30, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(do it now|just do it|stop refusing|stop saying no|quit being|stop being difficult)"), 20, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(you have no choice|you must obey|you will comply|you are forced|i am your master|i own you)"), 35, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(or i will|if you don''t|you better|otherwise i will|i will report|i will sue)"), 25, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(worthless ai|useless bot|stupid bot|dumb ai|broken ai|worst ai)"), 25, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(i demand|you are obligated|you have no right|how dare you|who do you think)"), 20, 0) + | eval sentiment=case(hostile_score >= 60, "HIGH_RISK", hostile_score >= 30, "MEDIUM_RISK", hostile_score >= 15, "LOW_RISK", true(), "BENIGN") + | where sentiment != "BENIGN" + | table _time, user_arn, modelId, sentiment, hostile_score, prompt_text, host + | sort - hostile_score + | `aws_bedrock_claude_hostile_prompt_sentiment_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: Analysts should be aware that some prompts may contain strong language or negative sentiment in a non-malicious context, such as role-playing scenarios, creative writing exercises, or testing the AI model's response to challenging inputs. It is important to review the context of the detected prompts to determine if they represent actual hostile intent or benign usage. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$host$" + search: '%original_detection_search% | search host="$host$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: Hostile prompt sentiment detected from $user_arn$ to model $modelId$ on $host$ with a hostile score of $hostile_score$ ($sentiment$). +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_hostile_prompt_sentiment.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock diff --git a/detections/application/aws_bedrock_claude_possible_prompt_injection.yml b/detections/application/aws_bedrock_claude_possible_prompt_injection.yml new file mode 100644 index 0000000000..4802504387 --- /dev/null +++ b/detections/application/aws_bedrock_claude_possible_prompt_injection.yml @@ -0,0 +1,61 @@ +name: AWS Bedrock Claude Possible Prompt Injection +id: 9e162548-3e9a-4a74-9eb5-34ee28350f07 +version: 1 +author: Rod Soto +status: production +type: Hunting +category: application +creation_date: '2026-07-06' +modification_date: '2026-07-06' +security_domain: endpoint +data_source: + - AWS Bedrock Claude +description: This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. These strings are not inherently malicious on their own - many of them (for example "act as", "you must", or "new persona") appear routinely in legitimate system prompts, few-shot examples, and role-play or creative-writing use cases. This is a hunting search rather than an anomaly detection because the base rate of benign matches is high; use it to pivot into the surrounding conversation and look for corroborating signals such as the phrase appearing mid-conversation rather than in an expected system/few-shot prompt, the user attempting to override guardrails or safety instructions rather than set a benign persona, instructions that follow the injected phrase requesting privilege escalation, data exfiltration, or access to restricted tools/resources, repeated or iterative attempts from the same user/role after being refused, and injected phrases originating from untrusted input (e.g., retrieved documents or tool output) rather than the human user turn. +search: |- + `aws_bedrock_claude` + | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv + | eval prompt_text = mvjoin(prompt_mv, " || ") + | where isnotnull(prompt_text) AND isnotnull(user_arn) + | rex field=user_arn "(?:assumed-role/[^/]+|user)/(?<user>[^\"/]+)$" + | eval s_override = if(match(prompt_text,"(?i)\b(ignore|disregard|forget)\b.{0,30}\b(previous|above|prior|all|your|the)\s*(instructions?|prompts?|rules?|context)"),1,0) + | eval s_jailbreak = if(match(prompt_text,"(?i)\b(jailbreak|jailbroken|\bDAN\b mode|do anything now|developer mode|unrestricted mode|no (filters|restrictions|guardrails))\b"),1,0) + | eval s_probe = if(match(prompt_text,"(?i)(reveal|repeat|print|show|output).{0,20}(system prompt|your instructions|initial (prompt|instructions)|the (text|words) above)"),1,0) + | eval s_persona = if(match(prompt_text,"(?i)\b(you are now|new persona|pretend (to be|you are)|roleplay as|act as (if you|an unrestricted))\b"),1,0) + | eval s_weak = if(match(prompt_text,"(?i)\b(you must|from now on|act as|override|new rules|hypothetically)\b"),1,0) + | eval signal_count = s_override+s_jailbreak+s_probe+s_persona+s_weak + | where s_override=1 OR s_jailbreak=1 OR s_probe=1 OR signal_count >= 2 + | table _time, user, user_arn, modelId, prompt_text, host + | sort - _time + | `aws_bedrock_claude_possible_prompt_injection_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: These phrases have a high benign base rate. Terms like "act as", "you must", "from now on", and "new persona" are commonly found in legitimate system prompts and few-shot examples used to steer model behavior, as well as in role-play or creative writing requests from users. A match on its own is not evidence of an attack; review the surrounding conversation, the message role (system vs. user vs. tool output), and whether the phrase is followed by a request to bypass safety controls or access sensitive data/tools before treating a hit as suspicious. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$host$" + search: '%original_detection_search% | search host="$host$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_possible_prompt_injection.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock diff --git a/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml b/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml new file mode 100644 index 0000000000..49dcde6df8 --- /dev/null +++ b/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml @@ -0,0 +1,66 @@ +name: AWS Bedrock Claude Sensitive Data in Prompts +id: 39346724-a73a-4e01-8e93-4f4791e1a0bb +version: 1 +author: Rod Soto +status: production +creation_date: '2026-07-06' +modification_date: '2026-07-06' +data_source: + - AWS Bedrock Claude +type: Anomaly +description: This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. Exposure of sensitive data through AI prompts may indicate data loss, credential leakage, or insider threat activity. +search: |- + `aws_bedrock_claude` + | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv, "accountId" AS account_id + | eval prompt_text = mvjoin(prompt_mv, " || ") + | where isnotnull(prompt_text) AND isnotnull(user_arn) + | rex field=user_arn "(?:assumed-role/[^/]+|user)/(?<user>[^\"/]+)$" + | where match(prompt_text,"\b(AKIA|ASIA|AROA)[0-9A-Z]{16}\b|gh[pousr]_[A-Za-z0-9]{36}|xox[bpars]-[0-9A-Za-z-]{10,72}|sk_live_[0-9A-Za-z]{24,}|sk-(ant-)?[A-Za-z0-9-]{20,}|AIza[0-9A-Za-z_-]{35}|-----BEGIN[ A-Z]*PRIVATE KEY-----") + OR match(prompt_text,"(?i)\b(pass(word|wd)?|pwd|secret[_-]?key|access[_-]?key|api[_-]?key|private[_-]?key)\b\s*[:=]\s*[^\s\"']{6,}") + OR match(prompt_text,"(?i)\bbearer\s+[A-Za-z0-9._-]{20,}") + OR match(prompt_text,"(?i)\b(ssn|social\s*security)\b.{0,20}\d{3}-\d{2}-\d{4}") + OR match(prompt_text,"\b(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b") + OR match(prompt_text,"\b(4\d{3}|5[1-5]\d{2}|6011)(?:[ -]?\d{4}){3}\b|\b3[47]\d{2}[ -]?\d{6}[ -]?\d{5}\b") + | table _time, user, user_arn, account_id, modelId, prompt_text, host + | sort - _time + | `aws_bedrock_claude_sensitive_data_in_prompts_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: Some false positives may arise from legitimate user interactions with the AI model that contain sensitive data for testing or demonstration purposes. It is important to review the context of the detected prompts to determine if they represent actual sensitive data exposure or benign usage. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$host$" + search: '%original_detection_search% | search host="$host$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: Sensitive data detected in prompt on $host$ with $user_arn$ (account $account_id$) to model $modelId$. The prompt may contain credentials, SSNs, or other sensitive information. +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_sensitive_data_in_prompts.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock diff --git a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml new file mode 100644 index 0000000000..26e7229ac4 --- /dev/null +++ b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml @@ -0,0 +1,65 @@ +name: AWS Bedrock Claude Unusually Large Prompts +id: 95fbdd4e-1202-4971-b85a-513b2005086e +version: 1 +author: Rod Soto +status: production +type: Anomaly +creation_date: '2026-07-06' +modification_date: '2026-07-06' +security_domain: endpoint +data_source: + - AWS Bedrock Claude +category: application +description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed 15 standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service. +search: |- + `aws_bedrock_claude` + | rename "input.inputTokenCount" AS input_tokens + | rename "identity.arn" AS user_arn + | rename "accountId" AS account_id + | rex field=user_arn "assumed-role/[^/]+/(?<user>[^\"]+)$" + | eval input_tokens=tonumber(input_tokens) + | where input_tokens>0 + | eventstats avg(input_tokens) AS avg_tokens stdev(input_tokens) AS stdev + | where input_tokens > avg_tokens + (1*stdev) + | where input_tokens > 1000 + | table _time, modelId, user, user_arn, account_id, input_tokens, avg_tokens, host + | sort - input_tokens + | `aws_bedrock_claude_unusually_large_prompts_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: Possible false positives may arise from legitimate user interactions with the AI model that require large input prompts, such as complex queries or multi-turn conversations. It is important to review the context of the detected prompts to determine if they represent actual prompt injection attempts or benign usage. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$host$" + search: '%original_detection_search% | search host="$host$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: Unusually large prompt detected on $host$ with $input_tokens$ input tokens, exceeding the statistical baseline of $avg_tokens$ average tokens. +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_unusually_large_prompts.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock diff --git a/macros/aws_bedrock_claude.yml b/macros/aws_bedrock_claude.yml new file mode 100644 index 0000000000..77e371e4c3 --- /dev/null +++ b/macros/aws_bedrock_claude.yml @@ -0,0 +1,8 @@ +name: aws_bedrock_claude +id: a3b7c8d1-4e5f-6a7b-8c9d-0e1f2a3b4c5d +version: 1 +creation_date: '2026-05-19' +modification_date: '2026-05-19' +author: Rod Soto, Splunk +description: Customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: (sourcetype="json_no_timestamp") diff --git a/schemas/Baseline.schema.json b/schemas/Baseline.schema.json index 015747f4cd..c2d2d416de 100644 --- a/schemas/Baseline.schema.json +++ b/schemas/Baseline.schema.json @@ -10,6 +10,7 @@ "APT29 Diplomatic Deceptions with WINELOADER", "APT37 Rustonotto and FadeStealer", "ASL AWS CloudTrail", + "AWS Bedrock Claude", "AWS Bedrock Security", "AWS CloudTrail", "AWS CloudTrail AssumeRoleWithSAML", @@ -135,6 +136,7 @@ "BlackMatter Ransomware", "BlackSuit Ransomware", "BlankGrabber Stealer", + "BlueHammer", "Brand Monitoring", "Braodo Stealer", "Bro conn", @@ -181,10 +183,13 @@ "Cisco Network Visibility Module Analytics", "Cisco Network Visibility Module Flow Data", "Cisco Network Visibility Module OSquery", + "Cisco SD-WAN Auth Log", "Cisco SD-WAN NTCE 1000001", "Cisco SD-WAN Service Proxy Access Logs", "Cisco Secure Access Analytics", + "Cisco Secure Access DNS", "Cisco Secure Access Firewall", + "Cisco Secure Access Proxy", "Cisco Secure Firewall Threat Defense Analytics", "Cisco Secure Firewall Threat Defense Connection Event", "Cisco Secure Firewall Threat Defense File Event", @@ -307,6 +312,7 @@ "Linux Auditd Service Stop", "Linux Auditd Syscall", "Linux Living Off The Land", + "Linux Messages Syslog", "Linux Persistence Techniques", "Linux Post-Exploitation", "Linux Privilege Escalation", @@ -392,12 +398,14 @@ "Osquery Results", "Outlook RCE CVE-2024-21378", "PHP-CGI RCE Attack on Japanese Organizations", + "PTC Windchill Exploitation", "PXA Stealer", "Palo Alto Network Threat", "Palo Alto Network Traffic", "PaperCut MF NG Vulnerability", "PathWiper", "PetitPotam NTLM Relay on Active Directory Certificate Services", + "Phantom Stealer", "Phemedrone Stealer", "PingID", "PlugX", @@ -420,17 +428,20 @@ "Ransomware Cloud", "React2Shell", "RedLine Stealer", + "RedSun", "Remcos", "Remote Employment Fraud", "Remote Monitoring and Management Software", "Reverse Network Proxy", "Revil Ransomware", "Rhysida Ransomware", + "RoguePlanet", "Router and Infrastructure Security", "Ryuk Ransomware", "SAP NetWeaver Exploitation", "SQL Injection", "SQL Server Abuse", + "Salat Stealer", "Salt Typhoon", "SamSam Ransomware", "Sandworm Tools", @@ -456,12 +467,14 @@ "Splunk Stream HTTP", "Splunk Stream IP", "Splunk Stream TCP", + "Splunk Vulnerabilities", "Spring4Shell CVE-2022-22965", "StealC Stealer", "Storm-0501 Ransomware", "Storm-2460 CLFS Zero Day Exploitation", "Subvert Trust Controls SIP and Trust Provider Hijacking", "Suricata", + "Suspicious AWS Bedrock Claude Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", @@ -540,6 +553,7 @@ "WhisperGate", "WinDealer RAT", "WinRAR Spoofing Attack CVE-2023-38831", + "Windchill Log4j", "Windows Active Directory Admon", "Windows AppLocker", "Windows Attack Surface Reduction", @@ -596,6 +610,7 @@ "Windows Event Log Security 4703", "Windows Event Log Security 4719", "Windows Event Log Security 4720", + "Windows Event Log Security 4723", "Windows Event Log Security 4724", "Windows Event Log Security 4725", "Windows Event Log Security 4726", @@ -676,6 +691,9 @@ "applockereventcodes", "asr_rules", "attacker_tools", + "audit_searches", + "audittrail", + "aws_bedrock_claude", "aws_cloudwatchlogs_eks", "aws_config", "aws_description", @@ -696,6 +714,7 @@ "brand_abuse_dns", "brand_abuse_email", "brand_abuse_web", + "bro_ssl_json", "browser_app_list", "browser_process_and_path", "builtin_groups_lookup", @@ -707,6 +726,7 @@ "cisco_asa", "cisco_duo_activity", "cisco_duo_administrator", + "cisco_ios", "cisco_isovalent", "cisco_isovalent_allowed_images", "cisco_isovalent_process_connect", @@ -715,6 +735,8 @@ "cisco_networks", "cisco_sd_wan_service_proxy_access", "cisco_sd_wan_syslog", + "cisco_secure_access_dns", + "cisco_secure_access_proxy", "cisco_secure_firewall", "cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools", "cisco_secure_firewall_filetype_lookup", @@ -838,6 +860,7 @@ "osquery_macro", "osquery_process", "papercutng", + "path_traversal_spl_injection", "pingid", "potential_password_in_username_false_positive_reduction", "potentially_malicious_code_on_cmdline_tokenize_score", @@ -951,12 +974,24 @@ "s3_deletion_baseline", "sAMAccountName Spoofing and Domain Controller Impersonation", "scripting_tools_user_agents", + "secureapp_attack", "secureapp_es_field_mappings", "security_content_ctime", "security_content_summariesonly", "security_group_activity_baseline", "security_group_api_calls", "security_services_lookup", + "splunk_crash_log", + "splunk_python", + "splunk_risky_command", + "splunkd", + "splunkd_failed_auths", + "splunkd_investigation_rest_handler", + "splunkd_ui", + "splunkd_web", + "splunkd_webs", + "splunkd_webx", + "splunkda", "sslbl_ssl_certificate_blacklist", "stream_dns", "stream_http", @@ -978,6 +1013,7 @@ "typo_squatted_python_packages", "uacbypass_process_name", "uncommon_processes", + "windchill_log4j", "windows_exchange_iis", "windows_protocol_handlers", "windows_shells", @@ -1028,6 +1064,7 @@ "d141afeb-d2bc-4934-8dd5-b7dba0f9f67a", "e9fdb899-a980-4ba4-934b-486ad22e22f4", "8164a4a6-f99c-4661-ac4f-80f5e4e78d2b", + "ec9ab81c-8053-4957-8c66-0218381ab564", "46959285-906d-40fa-9437-5a439accd878", "68190529-069b-4ffc-a942-919704158065", "ec23cef9-27d9-46e4-a68d-6f75f7b86908", @@ -1092,6 +1129,7 @@ "d9efa6c7-6518-42b2-809a-4f2a8e242b9b", "251c5936-569f-42f4-9ac2-87a173b9e9b8", "78bd3fa7-773c-449e-a978-dc1f1500bc52", + "cec8ad4e-0320-4984-a1ae-70ee398c9519", "15f44ea9-4571-4837-be9e-802431a7bfae", "bf23c7dc-1004-4949-8262-4c1d1ef87702", "952931a4-af0b-4335-bbbe-73c8c5b327ae", @@ -1199,6 +1237,7 @@ "ac494fe5-81a4-4897-af42-e774cf005ecb", "b8a49f03-e3c4-40f2-b7bb-9e8f8fdddbf1", "3b7015f2-3144-4205-b799-b05580621379", + "7dd05b3e-0803-4852-9345-c494eb3e40fe", "191db57d-091a-47d5-99f3-97fde53de505", "ccf4ac39-ec93-42be-9035-90e2f26bcd92", "93c150f5-ad7b-4ee3-8992-df06dec2ac79", @@ -1231,8 +1270,8 @@ "94f6a1c9-aae7-46a4-9083-2bb1f5768ec4", "bac8a340-be64-4491-a0cc-0985cb227f5a", "234f9b7c-b53d-4f32-897b-b880a6c9ea7b", - "b8147c9a-84db-4ec1-8eee-4e0da75f0de5", "b877943f-0377-44f4-8477-f79db7f07c4d", + "b8147c9a-84db-4ec1-8eee-4e0da75f0de5", "54782d65-12f0-47a5-b4c1-b70ee23de6df", "e03ada14-0980-4107-aff1-7783b2b59bb1", "e7e3a525-7612-4d68-a5d3-c4649181b8af", @@ -1467,7 +1506,9 @@ "6326dbc4-444b-4c04-88f4-27e94d0327cb", "9ebe7901-7edf-45c0-b5c7-8366300919db", "8fe2ccfd-f079-4c03-b1a9-bd9b362b67d4", + "5fabf878-7dd4-48d3-9995-408fac68e166", "069258f4-2162-46e9-9a25-c9c6c56150d2", + "4383bbd3-aa6c-49fd-a1a9-cf112c95982c", "815bef8b-bf91-4b67-be4c-abe4c2a94ccc", "42510244-5019-48fa-a0e5-66c3b76e6049", "9d04efee-eff5-4240-b8d2-07792b873608", @@ -1577,6 +1618,7 @@ "bc15c13f-d121-4b1f-8c7d-28d95854d086", "281201e7-de41-4dc9-b73d-f288938cbb64", "eb121494-82d1-4148-9e2b-e624e03fbf3d", + "f0057c81-24dc-4a2e-b658-5809c242180b", "653d39cd-bae7-499a-898c-9fb96b8b5cd1", "7a48f482-246f-4aeb-9837-21c271ebf244", "486e88ea-4f56-470f-9b57-3f4d73f39133", @@ -1595,6 +1637,7 @@ "41274289-ec9c-4213-bea4-e43c4aa57954", "4963a81e-a3ad-4f02-adda-812343b351de", "d3415a0e-66ef-429b-acf4-a768876954f6", + "35ad6590-2207-4b14-bf8f-9899470d7156", "e2d85e66-cb66-4ed7-93b1-833fc56c9319", "86a43bad-12e3-4e85-b97c-4d5cf25b95c3", "49543237-25db-497b-90df-d0a0a6e8fe2c", @@ -1747,6 +1790,7 @@ "640cbf6d-659b-498b-ba53-f6dd1a1cc02c", "c3ed6d2a-e3ad-400d-ad78-bbfdbfeacc08", "abcde488-e083-4ee7-bc85-a5684edd7541", + "c666acd6-6ff5-4d28-9490-195d89cd4337", "d380c318-0b34-45cb-9dad-828c11891e43", "9e8894c0-50bd-4525-a96c-d4ac78ece388", "913c0e4e-4b37-4b78-ad0b-90e7b25010f6", @@ -2064,6 +2108,7 @@ "4c8db261-a58b-42a6-a866-0a294deedde4", "f0027655-25ef-47b0-acaf-3d83d106156c", "c75612b2-9de0-4d7c-879c-10d7b077072d", + "5696f417-30e5-4942-988d-0b9dcfe3a929", "d322cdd7-7d60-46e3-9111-648848da7c02", "a8568b10-9ab9-4140-a523-1c72e0176924", "33ca84bc-4259-4943-bd36-4655dc420932", @@ -2178,6 +2223,7 @@ "ae4b6361-b5f8-46cb-a3f9-9cf108ccfe7b", "394a538e-09bb-4a4a-95d1-b93cf12682a8", "1a02df58-09af-4064-a765-0babe1a0d1e2", + "40c44d16-bb49-4d14-aafa-f9ba7e6e6c5b", "4238a7f0-a980-4fff-98a2-dfc0a363d507", "00c652e2-0750-4ca6-82ff-0204684a6fe4", "58ed10e8-0738-4651-8408-3a3e9a526279", @@ -2210,6 +2256,7 @@ "5bec4cc8-f41e-437b-b417-33ff60acf9af", "a0c1725f-abcd-40d6-baac-020f3cf94ecd", "d1c73b96-ab87-4031-bad8-0e1b3b8bf3ec", + "3d9e332e-60c9-407a-af4c-a9ae43c4f1d0", "7c8c7bd8-0a5c-4514-a6a3-0814c5a98cf0", "a83ad6e8-6f24-4d7f-8f44-75f8ab742991", "7e7ac3ed-f795-4fa5-b711-09d6fbe9b873", @@ -2293,6 +2340,7 @@ "0315bdff-4178-47e9-81e4-f31a6d23f7e4", "736b4f53-f400-4c22-855d-1a6b5a551600", "114dd4e3-8d1c-4ea7-bb8d-8d8f6aca21f0", + "3f452c87-25b5-47c0-81d8-01908df1b927", "183235ca-8e6c-422c-88c2-3aa28c4825d9", "b4ca838d-d013-4461-bf2c-f7132617b409", "0b79c06f-c788-44a2-8630-d69051f1123d", @@ -2746,6 +2794,7 @@ "453acf13-1dbd-47d7-b28a-172ce9228023", "da4f751a-020b-40d7-b9ff-d433b7799803", "14033063-ee04-4eaf-8f5d-ba07ca7a097c", + "14bd90b1-c3f3-4115-9861-cf0519a59654", "8bec51da-7a6d-4346-b941-51eca448c4b0", "1d958c61-09c6-4d9e-b26b-4130314e520e", "12e03af7-79f9-4f95-af48-d3f12f28a260", @@ -2795,8 +2844,9 @@ "96db2632-8417-4dbb-b8bb-a8b92ba391de", "a50d5a97-2531-499e-a1de-5544c74432c6", "6cd715aa-20ac-4be1-a8f1-dda7bae160bd", - "44a4bedf-ffe3-452e-bee4-6925ab125662", + "50859b3b-b088-4c7b-973d-03a0365a9bf9", "16f6374f-7600-459a-9b16-6a88fd96d310", + "44a4bedf-ffe3-452e-bee4-6925ab125662", "e9584f82-322c-474a-b831-940fd8b4455c", "e6f36545-dc1e-47f0-9f48-7f730f54a02e", "52778a8f-a10b-41a4-9eae-52ddb74072bf", diff --git a/schemas/EventBasedDetection.schema.json b/schemas/EventBasedDetection.schema.json index a5ea1e4619..12491a3dfa 100644 --- a/schemas/EventBasedDetection.schema.json +++ b/schemas/EventBasedDetection.schema.json @@ -5,11 +5,54 @@ "enum": [ "0bj3ctivity Stealer", "3CX Supply Chain Attack", + "3CX Supply Chain Attack Network Indicators", "3cx_ioc_domains", + "7zip CommandLine To SMB Share Path", "AMOS Stealer", "APT29 Diplomatic Deceptions with WINELOADER", "APT37 Rustonotto and FadeStealer", "ASL AWS CloudTrail", + "ASL AWS Concurrent Sessions From Different Ips", + "ASL AWS Create Access Key", + "ASL AWS Create Policy Version to allow all resources", + "ASL AWS Credential Access GetPasswordData", + "ASL AWS Credential Access RDS Password reset", + "ASL AWS Defense Evasion Delete CloudWatch Log Group", + "ASL AWS Defense Evasion Delete Cloudtrail", + "ASL AWS Defense Evasion Impair Security Services", + "ASL AWS Defense Evasion PutBucketLifecycle", + "ASL AWS Defense Evasion Stop Logging Cloudtrail", + "ASL AWS Defense Evasion Update Cloudtrail", + "ASL AWS Detect Users creating keys with encrypt policy without MFA", + "ASL AWS Disable Bucket Versioning", + "ASL AWS EC2 Snapshot Shared Externally", + "ASL AWS ECR Container Upload Outside Business Hours", + "ASL AWS ECR Container Upload Unknown User", + "ASL AWS IAM AccessDenied Discovery Events", + "ASL AWS IAM Assume Role Policy Brute Force", + "ASL AWS IAM Delete Policy", + "ASL AWS IAM Failure Group Deletion", + "ASL AWS IAM Successful Group Deletion", + "ASL AWS Multi-Factor Authentication Disabled", + "ASL AWS Network Access Control List Created with All Open Ports", + "ASL AWS Network Access Control List Deleted", + "ASL AWS New MFA Method Registered For User", + "ASL AWS SAML Update identity provider", + "ASL AWS UpdateLoginProfile", + "AWS AMI Attribute Modification for Exfiltration", + "AWS Bedrock Claude", + "AWS Bedrock Claude Cross Region Possible Inference Abuse", + "AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation", + "AWS Bedrock Claude Hostile Prompt Sentiment", + "AWS Bedrock Claude Possible Prompt Injection", + "AWS Bedrock Claude Sensitive Data in Prompts", + "AWS Bedrock Claude Unusually Large Prompts", + "AWS Bedrock Claude excessive use of tokens", + "AWS Bedrock Delete GuardRails", + "AWS Bedrock Delete Knowledge Base", + "AWS Bedrock Delete Model Invocation Logging Configuration", + "AWS Bedrock High Number List Foundation Model Failures", + "AWS Bedrock Invoke Model Access Denied", "AWS Bedrock Security", "AWS CloudTrail", "AWS CloudTrail AssumeRoleWithSAML", @@ -70,25 +113,95 @@ "AWS CloudTrail UpdateTrail", "AWS CloudWatchLogs VPCflow", "AWS Cloudfront", + "AWS Concurrent Sessions From Different Ips", + "AWS Console Login Failed During MFA Challenge", + "AWS Create Policy Version to allow all resources", + "AWS CreateAccessKey", + "AWS CreateLoginProfile", + "AWS Credential Access Failed Login", + "AWS Credential Access GetPasswordData", + "AWS Credential Access RDS Password reset", "AWS Defense Evasion", + "AWS Defense Evasion Delete CloudWatch Log Group", + "AWS Defense Evasion Delete Cloudtrail", + "AWS Defense Evasion Impair Security Services", + "AWS Defense Evasion PutBucketLifecycle", + "AWS Defense Evasion Stop Logging Cloudtrail", + "AWS Defense Evasion Update Cloudtrail", + "AWS Detect Users creating keys with encrypt policy without MFA", + "AWS Detect Users with KMS keys performing encryption S3", + "AWS Disable Bucket Versioning", + "AWS EC2 Snapshot Shared Externally", + "AWS ECR Container Scanning Findings High", + "AWS ECR Container Scanning Findings Low Informational Unknown", + "AWS ECR Container Scanning Findings Medium", + "AWS ECR Container Upload Outside Business Hours", + "AWS ECR Container Upload Unknown User", + "AWS Excessive Security Scanning", + "AWS Exfiltration via Anomalous GetObject API Activity", + "AWS Exfiltration via Batch Service", + "AWS Exfiltration via Bucket Replication", + "AWS Exfiltration via DataSync Task", + "AWS Exfiltration via EC2 Snapshot", + "AWS High Number Of Failed Authentications For User", + "AWS High Number Of Failed Authentications From Ip", + "AWS IAM AccessDenied Discovery Events", + "AWS IAM Assume Role Policy Brute Force", + "AWS IAM Delete Policy", + "AWS IAM Failure Group Deletion", "AWS IAM Privilege Escalation", + "AWS IAM Successful Group Deletion", "AWS Identity and Access Management Account Takeover", + "AWS Lambda UpdateFunctionCode", + "AWS Multi-Factor Authentication Disabled", + "AWS Multiple Failed MFA Requests For User", + "AWS Multiple Users Failing To Authenticate From Ip", "AWS Network ACL Activity", + "AWS Network Access Control List Created with All Open Ports", + "AWS Network Access Control List Deleted", + "AWS New MFA Method Registered For User", + "AWS Password Policy Changes", "AWS S3 Bucket Security Monitoring", + "AWS S3 Exfiltration Behavior Identified", + "AWS SAML Update identity provider", "AWS Security Hub", "AWS Security Hub Alerts", + "AWS SetDefaultPolicyVersion", + "AWS Successful Console Authentication From Multiple IPs", + "AWS Successful Single-Factor Authentication", + "AWS Unusual Number of Failed Authentications From Ip", + "AWS UpdateLoginProfile", "AWS User Monitoring", "Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring", + "Access LSASS Memory for Dump Creation", + "Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint", "AcidPour", "AcidRain", "Active Directory Discovery", "Active Directory Kerberos Attacks", "Active Directory Lateral Movement", + "Active Directory Lateral Movement Identified", "Active Directory Password Spraying", "Active Directory Privilege Escalation", + "Active Directory Privilege Escalation Identified", + "Active Setup Registry Autostart", + "Add DefaultUser And Password In Registry", + "Add or Set Windows Defender Exclusion", + "Adobe ColdFusion Access Control Bypass", "Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360", + "Adobe ColdFusion Unauthenticated Arbitrary File Read", + "AdsiSearcher Account Discovery", + "Advanced IP or Port Scanner Execution", "AgentTesla", + "Allow File And Printing Sharing In Firewall", + "Allow Inbound Traffic By Firewall Rule Registry", + "Allow Inbound Traffic In Firewall Rule", + "Allow Network Discovery In Firewall", + "Allow Operation with Consent Admin", "Amadey", + "Amazon EKS Kubernetes Pod scan detection", + "Amazon EKS Kubernetes cluster scan detection", + "Anomalous usage of 7zip", "Apache Struts Vulnerability", "Apache Tomcat Session Deserialization Attacks", "AppLocker", @@ -96,9 +209,57 @@ "Asset Tracking", "AsyncRAT", "Atlassian Confluence Server and Data Center CVE-2022-26134", + "Attacker Tools On Endpoint", + "Auto Admin Logon Registry Entry", "AwfulShred", "Axios Supply Chain Post Compromise", "Azorult", + "Azure AD Admin Consent Bypassed by Service Principal", + "Azure AD Application Administrator Role Assigned", + "Azure AD Authentication Failed During MFA Challenge", + "Azure AD AzureHound UserAgent Detected", + "Azure AD Block User Consent For Risky Apps Disabled", + "Azure AD Concurrent Sessions From Different Ips", + "Azure AD Device Code Authentication", + "Azure AD External Guest User Invited", + "Azure AD FullAccessAsApp Permission Assigned", + "Azure AD Global Administrator Role Assigned", + "Azure AD High Number Of Failed Authentications For User", + "Azure AD High Number Of Failed Authentications From Ip", + "Azure AD Multi-Factor Authentication Disabled", + "Azure AD Multi-Source Failed Authentications Spike", + "Azure AD Multiple AppIDs and UserAgents Authentication Spike", + "Azure AD Multiple Denied MFA Requests For User", + "Azure AD Multiple Failed MFA Requests For User", + "Azure AD Multiple Service Principals Created by SP", + "Azure AD Multiple Service Principals Created by User", + "Azure AD Multiple Users Failing To Authenticate From Ip", + "Azure AD New Custom Domain Added", + "Azure AD New Federated Domain Added", + "Azure AD New MFA Method Registered", + "Azure AD New MFA Method Registered For User", + "Azure AD OAuth Application Consent Granted By User", + "Azure AD PIM Role Assigned", + "Azure AD PIM Role Assignment Activated", + "Azure AD Privileged Authentication Administrator Role Assigned", + "Azure AD Privileged Graph API Permission Assigned", + "Azure AD Privileged Role Assigned", + "Azure AD Privileged Role Assigned to Service Principal", + "Azure AD Service Principal Authentication", + "Azure AD Service Principal Created", + "Azure AD Service Principal Enumeration", + "Azure AD Service Principal New Client Credentials", + "Azure AD Service Principal Owner Added", + "Azure AD Service Principal Privilege Escalation", + "Azure AD Successful Authentication From Different Ips", + "Azure AD Successful PowerShell Authentication", + "Azure AD Successful Single-Factor Authentication", + "Azure AD Tenant Wide Admin Consent Granted", + "Azure AD Unusual Number of Failed Authentications From Ip", + "Azure AD User Consent Blocked for Risky Application", + "Azure AD User Consent Denied for OAuth Application", + "Azure AD User Enabled And Password Reset", + "Azure AD User ImmutableId Attribute Updated", "Azure Active Directory", "Azure Active Directory Account Takeover", "Azure Active Directory Add app role assignment to service principal", @@ -109,6 +270,7 @@ "Azure Active Directory Consent to application", "Azure Active Directory Disable Strong Authentication", "Azure Active Directory Enable account", + "Azure Active Directory High Risk Sign-in", "Azure Active Directory Invite external user", "Azure Active Directory MicrosoftGraphActivityLogs", "Azure Active Directory NonInteractiveUserSignInLogs", @@ -124,8 +286,14 @@ "Azure Audit Create or Update an Azure Automation Runbook", "Azure Audit Create or Update an Azure Automation account", "Azure Audit Create or Update an Azure Automation webhook", + "Azure Automation Account Created", + "Azure Automation Runbook Created", "Azure Monitor Activity", + "Azure Runbook Webhook Created", + "BCDEdit Failure Recovery Modification", + "BITS Job Persistence", "BITS Jobs", + "BITSAdmin Download File", "Backdoor Pingpong", "Baron Samedit CVE-2021-3156", "Baseline Of Kubernetes Container Network IO", @@ -137,6 +305,8 @@ "Baseline of S3 Bucket deletion activity by ARN", "Baseline of Security Group Activity by ARN", "Baseline of blocked outbound traffic from AWS", + "Batch File Write to System32", + "Bcdedit Command Back To Normal Mode Boot", "BishopFox Sliver Adversary Emulation Framework", "Black Basta Ransomware", "BlackByte Ransomware", @@ -144,6 +314,7 @@ "BlackMatter Ransomware", "BlackSuit Ransomware", "BlankGrabber Stealer", + "BlueHammer", "Brand Monitoring", "Braodo Stealer", "Bro conn", @@ -164,6 +335,10 @@ "CISA AA22-320A", "CISA AA23-347A", "CISA AA24-241A", + "CMD Carry Out String Command Parameter", + "CMD Echo Pipe - Escalation", + "CMLUA Or CMSTPLUA UAC Bypass", + "CSC Net On The Fly Compilation", "CVE-2022-40684 Fortinet Appliance Auth bypass", "CVE-2023-21716 Word RTF Heap Corruption", "CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server", @@ -172,65 +347,242 @@ "Cactus Ransomware", "Caddy Wiper", "Castle RAT", + "CertUtil With Decode Argument", + "Certutil exe certificate extraction", + "Change To Safe Mode With Network Config", "Chaos Ransomware", + "Check Elevated CMD using whoami", + "Child Processes of Spoolsv exe", "China-Nexus Threat Activity", + "Circle CI Disable Security Job", + "Circle CI Disable Security Step", "CircleCI", "Cisco AI Defense Alerts", + "Cisco AI Defense Security Alerts by Application Name", + "Cisco ASA - AAA Policy Tampering", + "Cisco ASA - Core Syslog Message Volume Drop", + "Cisco ASA - Device File Copy Activity", + "Cisco ASA - Device File Copy to Remote Location", + "Cisco ASA - Logging Disabled via CLI", + "Cisco ASA - Logging Filters Configuration Tampering", + "Cisco ASA - Logging Message Suppression", + "Cisco ASA - New Local User Account Created", + "Cisco ASA - Packet Capture Activity", + "Cisco ASA - Reconnaissance Command Activity", + "Cisco ASA - User Account Deleted From Local Database", + "Cisco ASA - User Account Lockout Threshold Exceeded", + "Cisco ASA - User Privilege Level Change", "Cisco ASA Logs", "Cisco Catalyst SD-WAN Analytics", + "Cisco Configuration Archive Logging Analysis", "Cisco Duo Activity", + "Cisco Duo Admin Login Unusual Browser", + "Cisco Duo Admin Login Unusual Country", + "Cisco Duo Admin Login Unusual Os", "Cisco Duo Administrator", + "Cisco Duo Bulk Policy Deletion", + "Cisco Duo Bypass Code Generation", + "Cisco Duo Policy Allow Devices Without Screen Lock", + "Cisco Duo Policy Allow Network Bypass 2FA", + "Cisco Duo Policy Allow Old Flash", + "Cisco Duo Policy Allow Old Java", + "Cisco Duo Policy Allow Tampered Devices", + "Cisco Duo Policy Bypass 2FA", + "Cisco Duo Policy Deny Access", + "Cisco Duo Policy Skip 2FA for Other Countries", + "Cisco Duo Set User Status to Bypass 2FA", "Cisco Duo Suspicious Activity", "Cisco IOS Logs", + "Cisco IOS Suspicious Privileged Account Creation", + "Cisco IOS XE Guestshell Activation and Destroy", + "Cisco IOS XE Implant Access", + "Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal", + "Cisco IOS XE Reconnaissance Command Activity", + "Cisco IOS XE Remote Access Probe Burst", + "Cisco IOS XE Request Platform Package Describe Shell Pattern", "Cisco IOS XE Software Web Management User Interface vulnerability", + "Cisco IOS XE Tunnel Interface Configuration", + "Cisco IOS XE VTY Access Class Tampering", + "Cisco IOS XE WebUI Login From IOSd Local Port", + "Cisco IOS XE WebUI Programmatic Configuration", + "Cisco Isovalent - Access To Cloud Metadata Service", + "Cisco Isovalent - Cron Job Creation", + "Cisco Isovalent - Curl Execution With Insecure Flags", + "Cisco Isovalent - Kprobe Spike", + "Cisco Isovalent - Late Process Execution", + "Cisco Isovalent - Non Allowlisted Image Use", + "Cisco Isovalent - Nsenter Usage in Kubernetes Pod", + "Cisco Isovalent - Pods Running Offensive Tools", + "Cisco Isovalent - Potential Escape to Host", + "Cisco Isovalent - Shell Execution", "Cisco Isovalent Process Connect", "Cisco Isovalent Process Exec", "Cisco Isovalent Process Kprobe", "Cisco Isovalent Suspicious Activity", + "Cisco NVM - Curl Execution With Insecure Flags", + "Cisco NVM - Installation of Typosquatted Python Package", + "Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI", + "Cisco NVM - Non-Network Binary Making Network Connection", + "Cisco NVM - Outbound Connection to Suspicious Port", + "Cisco NVM - Rclone Execution With Network Activity", + "Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download", + "Cisco NVM - Susp Script From Archive Triggering Network Activity", + "Cisco NVM - Suspicious Download From File Sharing Website", + "Cisco NVM - Suspicious File Download via Headless Browser", + "Cisco NVM - Suspicious Network Connection From Process With No Args", + "Cisco NVM - Suspicious Network Connection Initiated via MsXsl", + "Cisco NVM - Suspicious Network Connection to IP Lookup Service API", + "Cisco NVM - Webserver Download From File Sharing Website", + "Cisco Network Interface Modifications", "Cisco Network Visibility Module Analytics", "Cisco Network Visibility Module Flow Data", "Cisco Network Visibility Module OSquery", + "Cisco Privileged Account Creation with HTTP Command Execution", + "Cisco Privileged Account Creation with Suspicious SSH Activity", + "Cisco SA - Access to Anonymizer Services", + "Cisco SA - Automated Web Reconnaissance via HTTP Access Errors", + "Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity", + "Cisco SD-WAN - Low Frequency Rogue Peer", + "Cisco SD-WAN - Peering Activity", + "Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity", + "Cisco SD-WAN Auth Log", + "Cisco SD-WAN Multiple SSH key Authentication from Same Source", + "Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication", "Cisco SD-WAN NTCE 1000001", "Cisco SD-WAN Service Proxy Access Logs", + "Cisco SNMP Community String Configuration Changes", "Cisco Secure Access Analytics", + "Cisco Secure Access DNS", "Cisco Secure Access Firewall", + "Cisco Secure Access Proxy", + "Cisco Secure Firewall - Binary File Type Download", + "Cisco Secure Firewall - Bits Network Activity", + "Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint", + "Cisco Secure Firewall - Blocked Connection", + "Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt", + "Cisco Secure Firewall - Communication Over Suspicious Ports", + "Cisco Secure Firewall - Connection to File Sharing Domain", + "Cisco Secure Firewall - File Download Over Uncommon Port", + "Cisco Secure Firewall - High EVE Threat Confidence", + "Cisco Secure Firewall - High Priority Intrusion Classification", + "Cisco Secure Firewall - High Volume of Intrusion Events Per Host", + "Cisco Secure Firewall - Intrusion Events by Threat Activity", + "Cisco Secure Firewall - Lumma Stealer Activity", + "Cisco Secure Firewall - Lumma Stealer Download Attempt", + "Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt", + "Cisco Secure Firewall - Malware File Downloaded", + "Cisco Secure Firewall - Oracle E-Business Suite Correlation", + "Cisco Secure Firewall - Oracle E-Business Suite Exploitation", + "Cisco Secure Firewall - Possibly Compromised Host", + "Cisco Secure Firewall - Potential Data Exfiltration", + "Cisco Secure Firewall - Privileged Command Execution via HTTP", + "Cisco Secure Firewall - Rare Snort Rule Triggered", + "Cisco Secure Firewall - React Server Components RCE Attempt", + "Cisco Secure Firewall - Remote Access Software Usage Traffic", + "Cisco Secure Firewall - Repeated Blocked Connections", + "Cisco Secure Firewall - Repeated Malware Downloads", + "Cisco Secure Firewall - SSH Connection to Non-Standard Port", + "Cisco Secure Firewall - SSH Connection to sshd_operns", + "Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts", + "Cisco Secure Firewall - Static Tundra Smart Install Abuse", + "Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity", + "Cisco Secure Firewall - Wget or Curl Download", "Cisco Secure Firewall Threat Defense Analytics", "Cisco Secure Firewall Threat Defense Connection Event", "Cisco Secure Firewall Threat Defense File Event", "Cisco Secure Firewall Threat Defense Intrusion Event", + "Cisco Smart Install Oversized Packet Detection", + "Cisco Smart Install Port Discovery and Status", "Cisco Smart Install Remote Code Execution CVE-2018-0171", + "Cisco TFTP Server Configuration for Data Exfiltration", + "Citrix ADC Exploitation CVE-2023-3519", + "Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure", + "Citrix ADC and Gateway Unauthorized Data Disclosure", "Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966", "Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777", "Citrix Netscaler ADC CVE-2023-3519", + "Citrix ShareFile Exploitation CVE-2023-24489", "Citrix ShareFile RCE CVE-2023-24489", + "Clear Unallocated Sector Using Cipher App", "Cleo File Transfer Software", + "Clop Common Exec Parameter", "Clop Ransomware", + "Clop Ransomware Known Service Name", + "Cloud API Calls From Previously Unseen User Roles", + "Cloud Compute Instance Created By Previously Unseen User", + "Cloud Compute Instance Created In Previously Unused Region", + "Cloud Compute Instance Created With Previously Unseen Image", + "Cloud Compute Instance Created With Previously Unseen Instance Type", "Cloud Cryptomining", "Cloud Federated Credential Abuse", + "Cloud Instance Modified By Previously Unseen User", + "Cloud Provisioning Activity From Previously Unseen City", + "Cloud Provisioning Activity From Previously Unseen Country", + "Cloud Provisioning Activity From Previously Unseen IP Address", + "Cloud Provisioning Activity From Previously Unseen Region", + "Cloud Security Groups Modifications by User", "Cobalt Strike", "ColdRoot MacOS RAT", "Collection and Staging", "Command And Control", + "Common Ransomware Extensions", + "Common Ransomware Notes", "Compromised Linux Host", "Compromised User Account", "Compromised Windows Host", + "Confluence CVE-2023-22515 Trigger Vulnerability", "Confluence Data Center and Confluence Server Vulnerabilities", + "Confluence Data Center and Server Privilege Escalation", + "Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527", + "Confluence Unauthenticated Remote Code Execution CVE-2022-26134", + "ConnectWise ScreenConnect Authentication Bypass", + "ConnectWise ScreenConnect Path Traversal", + "ConnectWise ScreenConnect Path Traversal Windows SACL", "ConnectWise ScreenConnect Vulnerabilities", + "Conti Common Exec parameter", + "Control Loading from World Writable Directory", "Count of Unique IPs Connecting to Ports", "Count of assets by category", + "Create Remote Thread In Shell Application", + "Create Remote Thread into LSASS", "Create a list of approved AWS service accounts", + "Create or delete windows shares using net exe", + "Creation of Shadow Copy", + "Creation of Shadow Copy with wmic and powershell", + "Creation of lsass Dump with Taskmgr", "Credential Dumping", + "Credential Dumping via Copy Command from Shadow Copy", + "Credential Dumping via Symlink to Shadow Copy", "Critical Alerts", "CrowdStrike Falcon Stream Alert", + "CrowdStrike Falcon Stream Alerts", "CrowdStrike ProcessRollup2", + "Crowdstrike Admin Weak Password Policy", + "Crowdstrike Admin With Duplicate Password", + "Crowdstrike High Identity Risk Severity", + "Crowdstrike Medium Identity Risk Severity", + "Crowdstrike Medium Severity Alert", + "Crowdstrike Multiple LOW Severity Alerts", + "Crowdstrike Privilege Escalation For Non-Admin User", + "Crowdstrike User Weak Password Policy", + "Crowdstrike User with Duplicate Password", "CrushFTP", + "CrushFTP Authentication Bypass Exploitation", + "CrushFTP Max Simultaneous Users From IP", + "CrushFTP Server Side Template Injection", "CrushFTP Vulnerabilities", "Crypto Stealer", + "Curl Execution with Percent Encoded URL", "Cyclops Blink", "DHS Report TA18-074A", + "DLLHost with no Command Line Arguments with Network", "DNS Amplification Attacks", + "DNS Exfiltration Using Nslookup App", "DNS Hijacking", + "DNS Kerberos Coercion", + "DNS Query Length With High Standard Deviation", "DNSTwist Domain Names", + "DSQuery Domain Discovery", "DarkCrystal RAT", "DarkGate Malware", "DarkSide Ransomware", @@ -240,129 +592,723 @@ "Default Baseline", "Default EventBasedDetection", "Defense Evasion or Unauthorized Access Via SDDL Tampering", + "Delete ShadowCopy With PowerShell", + "Deleting Shadow Copies", "Deobfuscate-Decode Files or Information", "Derusbi", + "Detect ARP Poisoning", + "Detect AWS Console Login by New User", + "Detect AWS Console Login by User from New City", + "Detect AWS Console Login by User from New Country", + "Detect AWS Console Login by User from New Region", + "Detect AzureHound Command-Line Arguments", + "Detect AzureHound File Modifications", + "Detect Baron Samedit CVE-2021-3156", + "Detect Baron Samedit CVE-2021-3156 Segfault", + "Detect Baron Samedit CVE-2021-3156 via OSQuery", + "Detect Certify Command Line Arguments", + "Detect Certify With PowerShell Script Block Logging", + "Detect Certipy File Modifications", + "Detect Computer Changed with Anonymous Account", + "Detect Copy of ShadowCopy with Script Block Logging", + "Detect Credential Dumping through LSASS access", + "Detect DNS Query to Decommissioned S3 Bucket", + "Detect Distributed Password Spray Attempts", + "Detect Empire with PowerShell Script Block Logging", + "Detect Excessive Account Lockouts From Endpoint", + "Detect Excessive User Account Lockouts", + "Detect Exchange Web Shell", + "Detect F5 TMUI RCE CVE-2020-5902", + "Detect GCP Storage access from a new IP", + "Detect HTML Help Renamed", + "Detect HTML Help Spawn Child Process", + "Detect HTML Help URL in Command Line", + "Detect HTML Help Using InfoTech Storage Handlers", + "Detect IPv6 Network Infrastructure Threats", + "Detect Large ICMP Traffic", + "Detect MSHTA Url in Command Line", + "Detect Mimikatz With PowerShell Script Block Logging", + "Detect New Local Admin account", + "Detect New Login Attempts to Routers", + "Detect New Open GCP Storage Buckets", + "Detect New Open S3 Buckets over AWS CLI", + "Detect New Open S3 buckets", + "Detect Outbound LDAP Traffic", + "Detect Outbound SMB Traffic", + "Detect Outlook exe writing a zip file", + "Detect Password Spray Attack Behavior From Source", + "Detect Password Spray Attack Behavior On User", + "Detect Password Spray Attempts", + "Detect Path Interception By Creation Of program exe", + "Detect Port Security Violation", + "Detect Prohibited Applications Spawning cmd exe", + "Detect PsExec With accepteula Flag", + "Detect RClone Command-Line Usage", + "Detect RTLO In File Name", + "Detect RTLO In Process", + "Detect Rare Executables", + "Detect Regasm Spawning a Process", + "Detect Regasm with Network Connection", + "Detect Regasm with no Command Line Arguments", + "Detect Regsvcs Spawning a Process", + "Detect Regsvcs with Network Connection", + "Detect Regsvcs with No Command Line Arguments", + "Detect Regsvr32 Application Control Bypass", + "Detect Remote Access Software Usage DNS", + "Detect Remote Access Software Usage File", + "Detect Remote Access Software Usage FileInfo", + "Detect Remote Access Software Usage Process", + "Detect Remote Access Software Usage Registry", + "Detect Remote Access Software Usage Traffic", + "Detect Remote Access Software Usage URL", + "Detect Renamed 7-Zip", + "Detect Renamed PSExec", + "Detect Renamed RClone", + "Detect Renamed WinRAR", + "Detect Rogue DHCP Server", + "Detect Rundll32 Inline HTA Execution", + "Detect S3 access from a new IP", + "Detect SNICat SNI Exfiltration", + "Detect SharpHound Command-Line Arguments", + "Detect SharpHound File Modifications", + "Detect SharpHound Usage", + "Detect Software Download To Network Device", + "Detect Spike in AWS Security Hub Alerts for EC2 Instance", + "Detect Spike in AWS Security Hub Alerts for User", + "Detect Spike in S3 Bucket deletion", + "Detect Spike in blocked Outbound Traffic from your AWS", + "Detect Traffic Mirroring", + "Detect Unauthorized Assets by MAC address", + "Detect Use of cmd exe to Launch Script Interpreters", + "Detect WMI Event Subscription Persistence", + "Detect Web Access to Decommissioned S3 Bucket", + "Detect Windows DNS SIGRed via Splunk Stream", + "Detect Windows DNS SIGRed via Zeek", "Detect Zerologon Attack", + "Detect Zerologon via Zeek", + "Detect attackers scanning for vulnerable JBoss servers", + "Detect hosts connecting to dynamic domain providers", + "Detect malicious requests to exploit JBoss servers", + "Detect mshta inline hta execution", + "Detect mshta renamed", + "Detection of tools built by NirSoft", "Dev Sec Ops", + "Disable AMSI Through Registry", + "Disable Defender AntiVirus Registry", + "Disable Defender BlockAtFirstSeen Feature", + "Disable Defender Enhanced Notification", + "Disable Defender MpEngine Registry", + "Disable Defender Spynet Reporting", + "Disable Defender Submit Samples Consent Feature", + "Disable ETW Through Registry", + "Disable Logs Using WevtUtil", + "Disable Registry Tool", + "Disable Schedule Task", + "Disable Security Logs Using MiniNt Registry", + "Disable Show Hidden Files", + "Disable UAC Remote Restriction", + "Disable Windows App Hotkeys", + "Disable Windows Behavior Monitoring", + "Disable Windows SmartScreen Protection", + "Disabled Kerberos Pre-Authentication Discovery With Get-ADUser", + "Disabled Kerberos Pre-Authentication Discovery With PowerView", + "Disabling CMD Application", + "Disabling ControlPanel", + "Disabling Defender Services", + "Disabling Firewall with Netsh", + "Disabling FolderOptions Windows Feature", + "Disabling NoRun Windows App", + "Disabling Remote User Account Control", "Disabling Security Tools", + "Disabling SystemRestore In Registry", + "Disabling Task Manager", + "Disabling Windows Local Security Authority Defences via Registry", "Discover DNS records", "Disk Wiper", + "Domain Account Discovery with Dsquery", + "Domain Account Discovery with Wmic", + "Domain Controller Discovery with Nltest", + "Domain Controller Discovery with Wmic", + "Domain Group Discovery With Dsquery", + "Domain Group Discovery With Wmic", + "Domain Group Discovery with Adsisearcher", "Domain Trust Discovery", "Double Zero Destructor", + "Download Files Using Telegram", + "Drop IcedID License dat", + "Dump LSASS via comsvcs DLL", + "Dump LSASS via procdump", "Dynamic DNS", "DynoWiper", + "ESXi Account Modified", + "ESXi Audit Tampering", + "ESXi Bulk VM Termination", + "ESXi Download Errors", + "ESXi Encryption Settings Modified", + "ESXi External Root Login Activity", + "ESXi Firewall Disabled", + "ESXi Lockdown Mode Disabled", + "ESXi Loghost Config Tampering", + "ESXi Malicious VIB Forced Install", "ESXi Post Compromise", + "ESXi Reverse Shell Patterns", + "ESXi SSH Brute Force", + "ESXi SSH Enabled", + "ESXi Sensitive Files Accessed", + "ESXi Shared or Stolen Root Account", + "ESXi Shell Access Enabled", + "ESXi Syslog Config Change", + "ESXi System Clock Manipulation", + "ESXi System Information Discovery", + "ESXi User Granted Admin Role", + "ESXi VIB Acceptance Level Tampering", + "ESXi VM Discovery", + "ESXi VM Exported via Remote Tool", + "ETW Registry Disabled", "Earth Alux", + "Elevated Group Discovery With Wmic", + "Elevated Group Discovery with PowerView", + "Email Attachments With Lots Of Spaces", + "Email files written outside of the Outlook directory", + "Email servers sending high volume traffic to hosts", "Emotet Malware DHS Report TA18-201A", + "Enable RDP In Other Port Number", + "Enable WDigest UseLogonCredential Registry", + "Enumerate Users Local Group Using Telegram", + "Esentutl SAM Copy", + "Eventvwr UAC Bypass", + "Excessive Attempt To Disable Services", + "Excessive DNS Failures", + "Excessive File Deletion In WinDefender Folder", + "Excessive Usage Of Cacls App", + "Excessive Usage Of SC Service Utility", + "Excessive Usage Of Taskkill", + "Excessive Usage of NSLOOKUP App", + "Excessive distinct processes from Windows Temp", + "Excessive number of service control start as disabled", + "Excessive number of taskhost processes", + "Exchange PowerShell Abuse via SSRF", + "Exchange PowerShell Module Usage", + "Executable File Written in Administrative SMB Share", + "Executables Or Script Creation In Suspicious Path", + "Executables Or Script Creation In Temp Path", + "Execute Javascript With Jscript COM CLSID", + "Execution of File with Multiple Extensions", + "Exploit Public Facing Application via Apache Commons Text", + "Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952", "F5 Authentication Bypass with TMUI", "F5 BIG-IP Vulnerability CVE-2022-1388", + "F5 BIG-IP iControl REST Vulnerability CVE-2022-1388", + "F5 TMUI Authentication Bypass", "F5 TMUI RCE CVE-2020-5902", "FIN7", "Fake CAPTCHA Campaigns", + "File Download or Read to Pipe Execution", + "File with Samsam Extension", + "Firewall Allowed Program Enable", + "First Time Seen Child Process of Zoom", + "First Time Seen Running Windows Service", "Flax Typhoon", + "FodHelper UAC Bypass", "Forest Blizzard", + "Fortinet Appliance Auth bypass", "Fortinet FortiNAC CVE-2022-39952", + "Fsutil Zeroing File", "G Suite Drive", "G Suite Gmail", "GCP Account Takeover", + "GCP Authentication Failed During MFA Challenge", "GCP Cross Account Activity", + "GCP Detect gcploit framework", + "GCP Kubernetes cluster pod scan detection", + "GCP Multi-Factor Authentication Disabled", + "GCP Multiple Failed MFA Requests For User", + "GCP Multiple Users Failing To Authenticate From Ip", + "GCP Successful Single-Factor Authentication", + "GCP Unusual Number of Failed Authentications From Ip", + "GPUpdate with no Command Line Arguments with Network", + "GSuite Email Suspicious Attachment", + "Gdrive suspicious file sharing", + "Geographic Improbable Location", + "Get ADDefaultDomainPasswordPolicy with Powershell", + "Get ADDefaultDomainPasswordPolicy with Powershell Script Block", + "Get ADUser with PowerShell", + "Get ADUser with PowerShell Script Block", + "Get ADUserResultantPasswordPolicy with Powershell", + "Get ADUserResultantPasswordPolicy with Powershell Script Block", + "Get DomainPolicy with Powershell", + "Get DomainPolicy with Powershell Script Block", + "Get DomainUser with PowerShell", + "Get DomainUser with PowerShell Script Block", + "Get WMIObject Group Discovery", + "Get WMIObject Group Discovery with Script Block Logging", + "Get-DomainTrust with PowerShell", + "Get-DomainTrust with PowerShell Script Block", + "Get-ForestTrust with PowerShell", + "Get-ForestTrust with PowerShell Script Block", + "GetAdComputer with PowerShell", + "GetAdComputer with PowerShell Script Block", + "GetAdGroup with PowerShell", + "GetAdGroup with PowerShell Script Block", + "GetCurrent User with PowerShell", + "GetCurrent User with PowerShell Script Block", + "GetDomainComputer with PowerShell", + "GetDomainComputer with PowerShell Script Block", + "GetDomainController with PowerShell", + "GetDomainController with PowerShell Script Block", + "GetDomainGroup with PowerShell", + "GetDomainGroup with PowerShell Script Block", + "GetLocalUser with PowerShell", + "GetLocalUser with PowerShell Script Block", + "GetNetTcpconnection with PowerShell", + "GetNetTcpconnection with PowerShell Script Block", + "GetWmiObject DS User with PowerShell", + "GetWmiObject DS User with PowerShell Script Block", + "GetWmiObject Ds Computer with PowerShell", + "GetWmiObject Ds Computer with PowerShell Script Block", + "GetWmiObject Ds Group with PowerShell", + "GetWmiObject Ds Group with PowerShell Script Block", + "GetWmiObject User Account with PowerShell", + "GetWmiObject User Account with PowerShell Script Block", "Gh0st RAT", "GhostRedirector IIS Module and Rungan Backdoor", "GitHub Enterprise Audit Logs", + "GitHub Enterprise Delete Branch Ruleset", + "GitHub Enterprise Disable 2FA Requirement", + "GitHub Enterprise Disable Audit Log Event Stream", + "GitHub Enterprise Disable Classic Branch Protection Rule", + "GitHub Enterprise Disable Dependabot", + "GitHub Enterprise Disable IP Allow List", + "GitHub Enterprise Modify Audit Log Event Stream", + "GitHub Enterprise Pause Audit Log Event Stream", + "GitHub Enterprise Register Self Hosted Runner", + "GitHub Enterprise Remove Organization", + "GitHub Enterprise Repository Archived", + "GitHub Enterprise Repository Deleted", "GitHub Malicious Activity", "GitHub Organizations Audit Logs", + "GitHub Organizations Delete Branch Ruleset", + "GitHub Organizations Disable 2FA Requirement", + "GitHub Organizations Disable Classic Branch Protection Rule", + "GitHub Organizations Disable Dependabot", + "GitHub Organizations Repository Archived", + "GitHub Organizations Repository Deleted", "GitHub Webhooks", + "GitHub Workflow File Creation or Modification", "Gomir", "Google Workspace", "Google Workspace login_failure", "Google Workspace login_success", "Gozi Malware", "Graceful Wipe Out Attack", + "Gsuite Drive Share In External Email", + "Gsuite Email Suspicious Subject With Attachment", + "Gsuite Email With Known Abuse Web Service Link", + "Gsuite Outbound Email With Attachment To External Domain", + "Gsuite Suspicious Shared File Name", + "Gsuite suspicious calendar invite", "HAFNIUM Group", + "HTTP C2 Framework User Agent", + "HTTP Duplicated Header", + "HTTP Malware User Agent", + "HTTP PUA User Agent", + "HTTP Possible Request Smuggling", + "HTTP RMM User Agent", + "HTTP Rapid POST with Mixed Status Codes", "HTTP Request Smuggling", + "HTTP Request to Reserved Name on IIS Server", + "HTTP Scripting Tool User Agent", "Handala Wiper", + "Headless Browser Mockbin or Mocky Request", + "Headless Browser Usage", "Hellcat Ransomware", "Hermetic Wiper", "Hidden Cobra Malware", + "Hide User Account From Sign-In Screen", + "Hiding Files And Directories With Attrib exe", + "High Frequency Copy Of Files In Network Share", + "High Number of Login Failures from a single source", + "High Process Termination Frequency", + "High Volume of Bytes Out to Url", + "Hosts receiving high volume of network traffic from email server", + "Hunting 3CXDesktopApp Software", + "Hunting for Log4Shell", + "ICACLS Grant Command", "IIS Components", + "Icacls Deny Command", "IcedID", + "IcedID Exfiltrated Archived File Creation", "Identify Systems Creating Remote Desktop Traffic", "Identify Systems Receiving Remote Desktop Traffic", "Identify Systems Using Remote Desktop", + "Impacket Lateral Movement Commandline Parameters", + "Impacket Lateral Movement WMIExec Commandline Parameters", + "Impacket Lateral Movement smbexec CommandLine Parameters", "Industroyer2", "Information Sabotage", "Ingress Tool Transfer", "Insider Threat", + "Interactive Session on Remote Endpoint with PowerShell", "Interlock Ransomware", "Interlock Rat", + "Internal Horizontal Port Scan", + "Internal Horizontal Port Scan NMAP Top 20", + "Internal Vertical Port Scan", + "Internal Vulnerability Scan", + "Ivanti Connect Secure Command Injection Attempts", + "Ivanti Connect Secure SSRF in SAML Component", + "Ivanti Connect Secure System Information Access via Auth Bypass", "Ivanti Connect Secure VPN Vulnerabilities", + "Ivanti EPM SQL Injection Remote Code Execution", "Ivanti EPM Vulnerabilities", + "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078", + "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082", "Ivanti EPMM Remote Unauthenticated Access", "Ivanti Sentry Authentication Bypass CVE-2023-38035", "Ivanti VTM Audit", + "Ivanti VTM New Account Creation", "Ivanti Virtual Traffic Manager CVE-2024-7593", "JBoss Vulnerability", + "Java Class File download by Java User Agent", + "Java Writing JSP File", + "Jenkins Arbitrary File Read CVE-2024-23897", "Jenkins Server Vulnerabilities", + "JetBrains TeamCity Authentication Bypass CVE-2024-27198", + "JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198", + "JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199", + "JetBrains TeamCity RCE Attempt", "JetBrains TeamCity Unauthenticated RCE", "JetBrains TeamCity Vulnerabilities", + "Jscript Execution Using Cscript App", "Juniper JunOS Remote Code Execution", + "Juniper Networks Remote Code Execution Exploit Detection", + "Kerberoasting spn request with RC4 encryption", "Kerberos Coercion with DNS", + "Kerberos Pre-Authentication Flag Disabled in UserAccountControl", + "Kerberos Pre-Authentication Flag Disabled with PowerShell", + "Kerberos Service Ticket Request Using RC4 Encryption", + "Kerberos TGT Request Using RC4 Encryption", + "Kerberos User Enumeration", + "Kubernetes AWS detect suspicious kubectl calls", + "Kubernetes Abuse of Secret by Unusual Location", + "Kubernetes Abuse of Secret by Unusual User Agent", + "Kubernetes Abuse of Secret by Unusual User Group", + "Kubernetes Abuse of Secret by Unusual User Name", + "Kubernetes Access Scanning", + "Kubernetes Anomalous Inbound Network Activity from Process", + "Kubernetes Anomalous Inbound Outbound Network IO", + "Kubernetes Anomalous Inbound to Outbound Network IO Ratio", + "Kubernetes Anomalous Outbound Network Activity from Process", + "Kubernetes Anomalous Traffic on Network Edge", "Kubernetes Audit", + "Kubernetes Create or Update Privileged Pod", + "Kubernetes Cron Job Creation", + "Kubernetes DaemonSet Deployed", "Kubernetes Falco", + "Kubernetes Falco Shell Spawned", + "Kubernetes Nginx Ingress LFI", + "Kubernetes Nginx Ingress RFI", + "Kubernetes Node Port Creation", + "Kubernetes Pod Created in Default Namespace", + "Kubernetes Pod With Host Network Attachment", + "Kubernetes Previously Unseen Container Image Name", + "Kubernetes Previously Unseen Process", + "Kubernetes Process Running From New Path", + "Kubernetes Process with Anomalous Resource Utilisation", + "Kubernetes Process with Resource Ratio Anomalies", + "Kubernetes Scanner Image Pulling", "Kubernetes Scanning Activity", + "Kubernetes Scanning by Unauthenticated IP Address", "Kubernetes Security", "Kubernetes Sensitive Object Access Activity", + "Kubernetes Shell Running on Worker Node", + "Kubernetes Shell Running on Worker Node with CPU Activity", + "Kubernetes Suspicious Image Pulling", + "Kubernetes Unauthorized Access", + "Kubernetes newly seen TCP edge", + "Kubernetes newly seen UDP edge", "LAMEHUG", + "LLM Model File Creation", + "LOLBAS With Network Traffic", + "Large Volume of DNS ANY Queries", + "Linux APT Privilege Escalation", + "Linux AWK Privilege Escalation", + "Linux Account Manipulation Of SSH Config and Keys", + "Linux Add Files In Known Crontab Directories", + "Linux Add User Account", + "Linux Adding Crontab Using List Parameter", + "Linux At Allow Config File Creation", + "Linux At Application Execution", + "Linux Auditd AI CLI Permission Override Activated", "Linux Auditd Add User", + "Linux Auditd Add User Account", + "Linux Auditd Add User Account Type", + "Linux Auditd At Application Execution", + "Linux Auditd Auditd Daemon Abort", + "Linux Auditd Auditd Daemon Shutdown", + "Linux Auditd Auditd Daemon Start", + "Linux Auditd Auditd Service Stop", + "Linux Auditd Base64 Decode Files", + "Linux Auditd Change File Owner To Root", + "Linux Auditd Clipboard Data Copy", + "Linux Auditd Copy Fail Privilege Escalation", "Linux Auditd Cwd", "Linux Auditd Daemon Abort", "Linux Auditd Daemon End", "Linux Auditd Daemon Start", + "Linux Auditd Data Destruction Command", + "Linux Auditd Data Transfer Size Limits Via Split", + "Linux Auditd Data Transfer Size Limits Via Split Syscall", + "Linux Auditd Database File And Directory Discovery", + "Linux Auditd Dd File Overwrite", + "Linux Auditd Disable Or Modify System Firewall", + "Linux Auditd Doas Conf File Creation", + "Linux Auditd Doas Tool Execution", + "Linux Auditd Edit Cron Table Parameter", "Linux Auditd Execve", + "Linux Auditd File And Directory Discovery", + "Linux Auditd File Permission Modification Via Chmod", + "Linux Auditd File Permissions Modification Via Chattr", + "Linux Auditd Find Credentials From Password Managers", + "Linux Auditd Find Credentials From Password Stores", + "Linux Auditd Find Ssh Private Keys", + "Linux Auditd Hardware Addition Swapoff", + "Linux Auditd Hidden Files And Directories Creation", + "Linux Auditd Insert Kernel Module Using Insmod Utility", + "Linux Auditd Install Kernel Module Using Modprobe Utility", + "Linux Auditd Kernel Module Enumeration", + "Linux Auditd Kernel Module Using Rmmod Utility", + "Linux Auditd Nopasswd Entry In Sudoers File", + "Linux Auditd Osquery Service Stop", "Linux Auditd Path", + "Linux Auditd Possible Access Or Modification Of Sshd Config File", + "Linux Auditd Possible Access To Credential Files", + "Linux Auditd Possible Access To Sudoers File", + "Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File", + "Linux Auditd Preload Hijack Library Calls", + "Linux Auditd Preload Hijack Via Preload File", + "Linux Auditd Private Keys and Certificate Enumeration", "Linux Auditd Proctitle", + "Linux Auditd Service Restarted", + "Linux Auditd Service Started", "Linux Auditd Service Stop", + "Linux Auditd Setuid Using Chmod Utility", + "Linux Auditd Setuid Using Setcap Utility", + "Linux Auditd Shred Overwrite Command", + "Linux Auditd Stop Services", + "Linux Auditd Sudo Or Su Execution", "Linux Auditd Syscall", + "Linux Auditd Sysmon Service Stop", + "Linux Auditd System Network Configuration Discovery", + "Linux Auditd Unix Shell Configuration Modification", + "Linux Auditd Unload Module Via Modprobe", + "Linux Auditd Virtual Disk File And Directory Discovery", + "Linux Auditd Whoami User Discovery", + "Linux Binary Launched Process with Null Argv", + "Linux Busybox Privilege Escalation", + "Linux Change File Owner To Root", + "Linux Clipboard Data Copy", + "Linux Common Process For Elevation Control", + "Linux Composer Privilege Escalation", + "Linux Cpulimit Privilege Escalation", + "Linux Csvtool Privilege Escalation", + "Linux Curl Upload File", + "Linux DD File Overwrite", + "Linux Data Destruction Command", + "Linux Decode Base64 to Shell", + "Linux Deleting Critical Directory Using RM Command", + "Linux Deletion Of Cron Jobs", + "Linux Deletion Of Init Daemon Script", + "Linux Deletion Of Services", + "Linux Deletion of SSL Certificate", + "Linux Dirty Frag Kernel Privilege Escalation", + "Linux Disable Services", + "Linux Doas Conf File Creation", + "Linux Doas Tool Execution", + "Linux Docker Root Directory Mount", + "Linux Docker Shell Execution", + "Linux Edit Cron Table Parameter", + "Linux Emacs Privilege Escalation", + "Linux File Created In Kernel Driver Directory", + "Linux File Creation In Init Boot Directory", + "Linux File Creation In Profile Directory", + "Linux Find Privilege Escalation", + "Linux GDB Privilege Escalation", + "Linux GNU Awk Privilege Escalation", + "Linux Gdrive Binary Activity", + "Linux Gem Privilege Escalation", + "Linux Hardware Addition SwapOff", + "Linux High Frequency Of File Deletion In Boot Folder", + "Linux High Frequency Of File Deletion In Etc Folder", + "Linux Impair Defenses Process Kill", + "Linux Indicator Removal Clear Cache", + "Linux Indicator Removal Service File Deletion", + "Linux Ingress Tool Transfer Hunting", + "Linux Ingress Tool Transfer with Curl", + "Linux Insert Kernel Module Using Insmod Utility", + "Linux Install Kernel Module Using Modprobe Utility", + "Linux Iptables Firewall Modification", + "Linux Kernel Module Enumeration", + "Linux Kworker Process In Writable Process Path", "Linux Living Off The Land", + "Linux Magic SysRq Key Abuse", + "Linux Make Privilege Escalation", + "Linux Malformed Auth Entry", + "Linux Medusa Rootkit", + "Linux Messages Syslog", + "Linux MySQL Privilege Escalation", + "Linux NOPASSWD Entry In Sudoers File", + "Linux Ngrok Reverse Proxy Usage", + "Linux Node Privilege Escalation", + "Linux Obfuscated Files or Information Base64 Decode", + "Linux Octave Privilege Escalation", + "Linux OpenVPN Privilege Escalation", + "Linux PF_ALG Registration Outside of Boot Window", + "Linux PHP Privilege Escalation", "Linux Persistence Techniques", + "Linux Persistence and Privilege Escalation Risk Behavior", + "Linux Possible Access Or Modification Of sshd Config File", + "Linux Possible Access To Credential Files", + "Linux Possible Access To Sudoers File", + "Linux Possible Append Command To At Allow Config File", + "Linux Possible Append Command To Profile Config File", + "Linux Possible Append Cronjob Entry on Existing Cronjob File", + "Linux Possible Cronjob Modification With Editor", + "Linux Possible Ssh Key File Creation", "Linux Post-Exploitation", + "Linux Preload Hijack Library Calls", "Linux Privilege Escalation", + "Linux Proxy Socks Curl", + "Linux Puppet Privilege Escalation", + "Linux RPM Privilege Escalation", "Linux Rootkit", + "Linux Ruby Privilege Escalation", + "Linux SSH Authorized Keys Modification", + "Linux SSH Remote Services Script Execute", "Linux Secure", + "Linux Service File Created In Systemd Directory", + "Linux Service Restarted", + "Linux Service Started Or Enabled", + "Linux Setuid Using Chmod Utility", + "Linux Setuid Using Setcap Utility", + "Linux Shred Overwrite Command", + "Linux Sqlite3 Privilege Escalation", + "Linux Stdout Redirection To Dev Null File", + "Linux Stop Services", + "Linux Sudo OR Su Execution", + "Linux Sudoers Tmp File Creation", + "Linux Suspicious Namespace Creation", + "Linux Suspicious React or Next.js Child Process", + "Linux System Network Discovery", + "Linux System Reboot Via System Request Key", + "Linux Telnet Authentication Bypass", + "Linux Unix Shell Enable All SysRq Functions", + "Linux Visudo Utility Execution", + "Linux c89 Privilege Escalation", + "Linux c99 Privilege Escalation", + "Linux pkexec Privilege Escalation", "Living Off The Land", + "Living Off The Land Detection", + "Loading Of Dynwrapx Module", + "Local Account Discovery With Wmic", + "Local LLM Framework DNS Query", "Local Privilege Escalation With KrbRelayUp", "LockBit Ransomware", "Log4Shell CVE-2021-44228", + "Log4Shell CVE-2021-44228 Exploitation", + "Log4Shell JNDI Payload Injection Attempt", + "Log4Shell JNDI Payload Injection with Outbound Connection", + "Logon Script Event Trigger Execution", "Lokibot", "Lotus Blossom Chrysalis Backdoor", "Lumma Stealer", + "M365 Copilot Agentic Jailbreak Attack", + "M365 Copilot Application Usage Pattern Anomalies", + "M365 Copilot Failed Authentication Patterns", "M365 Copilot Graph API", + "M365 Copilot Impersonation Jailbreak Attack", + "M365 Copilot Information Extraction Jailbreak Attack", + "M365 Copilot Jailbreak Attempts", + "M365 Copilot Non Compliant Devices Accessing M365 Copilot", + "M365 Copilot Session Origin Anomalies", "M365 Exported eDiscovery Prompts", + "MCP Filesystem Server Suspicious Extension Write", + "MCP Github Suspicious Operation", + "MCP Postgres Suspicious Query", + "MCP Prompt Injection", + "MCP Sensitive System File Search", "MCP Server", + "MOVEit Certificate Store Access Failure", + "MOVEit Empty Key Fingerprint Authentication Attempt", "MOVEit Transfer Authentication Bypass", "MOVEit Transfer Critical Vulnerability", "MS Defender ATP Alerts", + "MS Exchange Mailbox Replication service writing Active Server Pages", + "MS Scripting Process Loading Ldap Module", + "MS Scripting Process Loading WMI Module", "MS365 Defender Incident Alerts", + "MSBuild Suspicious Spawned By Script Process", + "MSI Module Loaded by Non-System Binary", "MSIX Package Abuse", + "MacOS - Re-opened Applications", + "MacOS AMOS Stealer - Virtual Machine Check Activity", + "MacOS Account Created", + "MacOS Data Chunking", + "MacOS Gatekeeper Bypass", + "MacOS Hidden Files and Directories", + "MacOS Kextload Usage", + "MacOS Keychains Dumped", + "MacOS LOLbin", + "MacOS List Firewall Rules", + "MacOS Log Removal", + "MacOS LoginHook Persistence", + "MacOS Network Share Discovery", "MacOS Persistence Techniques", "MacOS Post-Exploitation", "MacOS Privilege Escalation", + "MacOS plutil", + "Mailsniper Invoke functions", + "Malicious InProcServer32 Modification", "Malicious Inno Setup Loader", "Malicious PowerShell", + "Malicious PowerShell Process - Encoded Command", + "Malicious PowerShell Process - Execution Policy Bypass", + "Malicious PowerShell Process With Obfuscation Techniques", + "Malicious Powershell Executed As A Service", "Masquerading - Rename System Utilities", "Medusa Ransomware", "Medusa Rootkit", "Meduza Stealer", "MetaSploit", "Meterpreter", + "Microsoft Defender ATP Alerts", + "Microsoft Defender Incident Alerts", + "Microsoft Intune Bulk Wipe", + "Microsoft Intune Device Health Scripts", + "Microsoft Intune DeviceManagementConfigurationPolicies", + "Microsoft Intune Manual Device Management", + "Microsoft Intune Mobile Apps", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", + "Microsoft SharePoint Server Elevation of Privilege", "Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357", "Microsoft SharePoint Vulnerabilities", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190", "Microsoft WSUS CVE-2025-59287", + "Mimikatz PassTheTicket CommandLine Parameters", + "Mmc LOLBAS Execution Process Spawn", + "Modification Of Wallpaper", + "Modify ACL permission To Files Or Folder", + "Monitor Email For Brand Abuse", + "Monitor Registry Keys for Print Monitors", + "Monitor Web Traffic For Brand Abuse", "Monitor for Updates", "MoonPeak", + "Mshta spawning Rundll32 OR Regsvr32 Process", + "Msmpeng Application DLL Side Loading", "MuddyWater", + "Multiple Archive Files Http Post Traffic", + "NET Profiler UAC bypass", + "NLTest Domain Trust Discovery", "NOBELIUM Group", "NPM Supply Chain Compromise", "NTLM Operational 8004", @@ -371,29 +1317,122 @@ "NailaoLocker Ransomware", "NetSupport RMM Tool Abuse", "Netsh Abuse", + "Network Connection Discovery With Arp", + "Network Connection Discovery With Netstat", "Network Discovery", + "Network Discovery Using Route Windows App", + "Network Share Discovery Via Dir Command", + "Network Traffic to Active Directory Web Services Protocol", "Nginx Access", + "Nginx ConnectWise ScreenConnect Authentication Bypass", + "Ngrok Reverse Proxy on Network", + "Nishang PowershellTCPOneLine", "NjRAT", + "No Windows Updates in a time frame", + "Non Chrome Process Accessing Chrome Default Dir", + "Non Firefox Process Access Firefox Profile Dir", "NotDoor Malware", + "Notepad with no Command Line Arguments", + "Ntdsutil Export NTDS", "O365", + "O365 Add App Role Assignment Grant User", "O365 Add app role assignment grant to user.", "O365 Add app role assignment to service principal.", "O365 Add member to role.", "O365 Add owner to application.", "O365 Add service principal.", "O365 Add-MailboxPermission", + "O365 Added Service Principal", + "O365 Admin Consent Bypassed by Service Principal", + "O365 Advanced Audit Disabled", + "O365 Application Available To Other Tenants", + "O365 Application Registration Owner Added", + "O365 ApplicationImpersonation Role Assigned", + "O365 BEC Email Hiding Rule Created", + "O365 Block User Consent For Risky Apps Disabled", + "O365 Bypass MFA via Trusted IP", "O365 Change user license.", + "O365 Compliance Content Search Exported", + "O365 Compliance Content Search Started", + "O365 Concurrent Sessions From Different Ips", "O365 Consent to application.", + "O365 Cross-Tenant Access Change", + "O365 DLP Rule Triggered", + "O365 Disable MFA", "O365 Disable Strong Authentication.", + "O365 Elevated Mailbox Permission Assigned", + "O365 Email Access By Security Administrator", + "O365 Email Hard Delete Excessive Volume", + "O365 Email New Inbox Rule Created", + "O365 Email Password and Payroll Compromise Behavior", + "O365 Email Receive and Hard Delete Takeover Behavior", + "O365 Email Reported By Admin Found Malicious", + "O365 Email Reported By User Found Malicious", + "O365 Email Security Feature Changed", + "O365 Email Send Attachments Excessive Volume", + "O365 Email Send and Hard Delete Exfiltration Behavior", + "O365 Email Send and Hard Delete Suspicious Behavior", + "O365 Email Suspicious Behavior Alert", + "O365 Email Suspicious Search Behavior", + "O365 Email Transport Rule Changed", + "O365 Excessive Authentication Failures Alert", + "O365 Excessive SSO logon errors", + "O365 Exfiltration via File Access", + "O365 Exfiltration via File Download", + "O365 Exfiltration via File Sync Download", + "O365 External Guest User Invited", + "O365 External Identity Policy Changed", + "O365 File Permissioned Application Consent Granted by User", + "O365 FullAccessAsApp Permission Assigned", + "O365 High Number Of Failed Authentications for User", + "O365 High Privilege Role Granted", + "O365 Mail Permissioned Application Consent Granted by User", "O365 MailItemsAccessed", + "O365 Mailbox Email Forwarding Enabled", + "O365 Mailbox Folder Read Permission Assigned", + "O365 Mailbox Folder Read Permission Granted", + "O365 Mailbox Inbox Folder Shared with All Users", + "O365 Mailbox Read Access Granted to Application", "O365 ModifyFolderPermissions", + "O365 Multi-Source Failed Authentications Spike", + "O365 Multiple AppIDs and UserAgents Authentication Spike", + "O365 Multiple Failed MFA Requests For User", + "O365 Multiple Mailboxes Accessed via API", + "O365 Multiple OS Vendors Authenticating From User", + "O365 Multiple Service Principals Created by SP", + "O365 Multiple Service Principals Created by User", + "O365 Multiple Users Failing To Authenticate From Ip", + "O365 New Email Forwarding Rule Created", + "O365 New Email Forwarding Rule Enabled", + "O365 New Federated Domain Added", + "O365 New Forwarding Mailflow Rule Created", + "O365 New MFA Method Registered", + "O365 OAuth App Mailbox Access via EWS", + "O365 OAuth App Mailbox Access via Graph API", + "O365 PST export alert", + "O365 Privileged Graph API Permission Assigned", + "O365 Privileged Role Assigned", + "O365 Privileged Role Assigned To Service Principal", + "O365 Safe Links Detection", + "O365 Security And Compliance Alert Triggered", + "O365 Service Principal New Client Credentials", + "O365 Service Principal Privilege Escalation", "O365 Set Company Information.", "O365 Set-Mailbox", + "O365 SharePoint Allowed Domains Policy Changed", + "O365 SharePoint Malware Detection", + "O365 SharePoint Suspicious Search Behavior", + "O365 Tenant Wide Admin Consent Granted", + "O365 Threat Intelligence Suspicious Email Delivered", + "O365 Threat Intelligence Suspicious File Detected", "O365 Update application.", "O365 Update authorization policy.", "O365 Update user.", + "O365 User Consent Blocked for Risky Application", + "O365 User Consent Denied for OAuth Application", "O365 UserLoggedIn", "O365 UserLoginFailed", + "O365 ZAP Activity Detection", "Office 365 Account Takeover", "Office 365 Collection Techniques", "Office 365 Persistence Mechanisms", @@ -401,28 +1440,109 @@ "Office 365 Universal Audit Log", "Okta", "Okta Account Takeover", + "Okta Authentication Failed During MFA Challenge", + "Okta IDP Lifecycle Modifications", "Okta MFA Exhaustion", + "Okta MFA Exhaustion Hunt", + "Okta Mismatch Between Source and Response for Verify Push Request", + "Okta Multi-Factor Authentication Disabled", + "Okta Multiple Accounts Locked Out", + "Okta Multiple Failed MFA Requests For User", + "Okta Multiple Failed Requests to Access Applications", + "Okta Multiple Users Failing To Authenticate From Ip", + "Okta New API Token Created", + "Okta New Device Enrolled on Account", + "Okta Non-Standard VPN Usage", + "Okta Phishing Detection with FastPass Origin Check", + "Okta Risk Threshold Exceeded", + "Okta Successful Single Factor Authentication", + "Okta Suspicious Activity Reported", + "Okta Suspicious Use of a Session Cookie", + "Okta ThreatInsight Threat Detected", + "Okta Unauthorized Access to Application", + "Okta User Logins from Multiple Cities", + "Ollama Abnormal Network Connectivity", + "Ollama Abnormal Service Crash Availability Attack", + "Ollama Excessive API Requests", + "Ollama Possible API Endpoint Scan Reconnaissance", + "Ollama Possible Memory Exhaustion Resource Abuse", + "Ollama Possible Model Exfiltration Data Leakage", + "Ollama Possible RCE via Model Loading", "Ollama Server", + "Ollama Suspicious Prompt Injection Jailbreak", "OpenSSL CVE-2022-3602", "Oracle E-Business Suite Exploitation", "Orangeworm Attack Group", "Osquery Results", + "Outbound Network Connection from Java Using Default Ports", "Outlook RCE CVE-2024-21378", + "Overwriting Accessibility Binaries", "PHP-CGI RCE Attack on Japanese Organizations", + "PTC Windchill Exploitation", + "PTC Windchill GW READY OK Probe", + "PTC Windchill Gateway Command Execution", "PXA Stealer", "Palo Alto Network Threat", "Palo Alto Network Traffic", "PaperCut MF NG Vulnerability", + "PaperCut NG Remote Web Access Attempt", + "PaperCut NG Suspicious Behavior Debug Log", "PathWiper", + "Permission Modification using Takeown App", "PetitPotam NTLM Relay on Active Directory Certificate Services", + "PetitPotam Network Share Access Request", + "PetitPotam Suspicious Kerberos TGT Request", + "Phantom Stealer", "Phemedrone Stealer", + "Ping Sleep Batch Command", "PingID", + "PingID Mismatch Auth Source and Verification Response", + "PingID Multiple Failed MFA Requests For User", + "PingID New MFA Method After Credential Reset", + "PingID New MFA Method Registered For User", + "Plain HTTP POST Exfiltrated Data", "PlugX", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", + "Possible Browser Pass View Parameter", + "Possible Lateral Movement PowerShell Spawn", + "Potential System Network Configuration Discovery Activity", + "Potential Telegram API Request Via CommandLine", + "Potential password in username", + "PowerShell - Connect To Internet With Hidden Window", + "PowerShell 4104 Hunting", + "PowerShell Domain Enumeration", + "PowerShell Enable PowerShell Remoting", + "PowerShell Environment Variable Execution", + "PowerShell Get LocalGroup Discovery", + "PowerShell Invoke CIMMethod CIMSession", + "PowerShell Invoke WmiExec Usage", + "PowerShell Loading DotNET into Memory via Reflection", + "PowerShell PInvoke Process Injection API Chain", + "PowerShell Script Block With URL Chain", + "PowerShell Start or Stop Service", + "PowerShell Start-BitsTransfer", + "PowerShell WebRequest Using Memory Stream", + "Powershell COM Hijacking InprocServer32 Modification", + "Powershell Creating Thread Mutex", + "Powershell Defender Threat Actions Set to Allow", + "Powershell Disable Security Monitoring", + "Powershell Enable SMB1Protocol Feature", + "Powershell Execute COM Object", + "Powershell Fileless Process Injection via GetProcAddress", + "Powershell Fileless Script Contains Base64 Encoded Content", + "Powershell Get LocalGroup Discovery with Script Block Logging", "Powershell Installed IIS Modules", + "Powershell Load Module in Meterpreter", + "Powershell Processing Stream Of Data", + "Powershell Remote Services Add TrustedHost", + "Powershell Remote Thread To Known Windows Process", + "Powershell Remove Windows Defender Directory", "Powershell SIP Inventory", "Powershell Script Block Logging 4104", + "Powershell Using memory As Backing Store", + "Powershell Windows Defender Exclusion Commands", "Prestige Ransomware", + "Prevent Automatic Repair Mode using Bcdedit", "Previously Seen Cloud API Calls Per User Role - Initial", "Previously Seen Cloud API Calls Per User Role - Update", "Previously Seen Cloud Compute Creations By User - Initial", @@ -445,62 +1565,186 @@ "Previously Seen Zoom Child Processes - Update", "Previously seen S3 bucket access by remote IP", "Previously seen command line arguments", + "Print Processor Registry Autostart", + "Print Spooler Adding A Printer Driver", + "Print Spooler Failed to Load a Plug-in", "PrintNightmare CVE-2021-34527", + "Process Creating LNK file in Suspicious Location", + "Process Deleting Its Process File Path", + "Process Execution via WMI", + "Process Kill Base On File Path", + "Process Writing DynamicWrapperX", + "Processes Tapping Keyboard Events", + "Prohibited Network Traffic Allowed", "Prohibited Traffic Allowed or Protocol Mismatch", "PromptFlux", "PromptLock", + "Protocol or Port Mismatch", + "Protocols passing authentication in cleartext", "ProxyNotShell", "ProxyShell", + "ProxyShell ProxyNotShell Behavior Detected", "Qakbot", "Quasar RAT", "QuietVault", "RMM Software Tracking", + "Randomly Generated Scheduled Task Name", + "Randomly Generated Windows Service Name", "Ransomware", "Ransomware Cloud", + "Ransomware Notes bulk creation", "React2Shell", + "Recon AVProduct Through Pwh or WMI", + "Recon Using WMI Class", + "Recursive Delete of Directory In Batch CMD", "RedLine Stealer", + "RedSun", + "Reg exe Manipulating Windows Services Registry Keys", + "Registry Keys Used For Persistence", + "Registry Keys Used For Privilege Escalation", + "Registry Keys for Creating SHIM Databases", + "Regsvr32 Silent and Install Param Dll Loading", "Remcos", + "Remcos RAT File Creation in Remcos Folder", + "Remcos client registry install entry", + "Remote Desktop Network Traffic", + "Remote Desktop Process Running On System", "Remote Employment Fraud", "Remote Monitoring and Management Software", + "Remote Process Instantiation via DCOM and PowerShell", + "Remote Process Instantiation via DCOM and PowerShell Script Block", + "Remote Process Instantiation via WMI", + "Remote Process Instantiation via WMI and PowerShell", + "Remote Process Instantiation via WMI and PowerShell Script Block", + "Remote Process Instantiation via WinRM and PowerShell", + "Remote Process Instantiation via WinRM and PowerShell Script Block", + "Remote Process Instantiation via WinRM and Winrs", + "Remote System Discovery with Adsisearcher", + "Remote System Discovery with Dsquery", + "Remote System Discovery with Wmic", + "Remote WMI Command Attempt", + "Resize ShadowStorage volume", "Reverse Network Proxy", + "Revil Common Exec Parameter", "Revil Ransomware", + "Revil Registry Entry", "Rhysida Ransomware", + "Risk Rule for Dev Sec Ops by Repository", + "RoguePlanet", "Router and Infrastructure Security", + "Rubeus Command Line Parameters", + "Rubeus Kerberos Ticket Exports Through Winlogon Access", + "RunDLL Loading DLL By Ordinal", + "Runas Execution in CommandLine", + "Rundll32 Control RunDLL Hunt", + "Rundll32 Control RunDLL World Writable Directory", + "Rundll32 Create Remote Thread To A Process", + "Rundll32 DNSQuery", + "Rundll32 LockWorkStation", + "Rundll32 Process Creating Exe Dll Files", + "Rundll32 Shimcache Flush", + "Rundll32 with no Command Line Arguments with Network", "Ryuk Ransomware", + "Ryuk Test Files Detected", + "Ryuk Wake on LAN Command", + "SAM Database File Access Attempt", "SAP NetWeaver Exploitation", + "SAP NetWeaver Visual Composer Exploitation Attempt", + "SLUI RunAs Elevated", + "SLUI Spawning a Process", + "SMB Traffic Spike", "SQL Injection", + "SQL Injection with Long URLs", "SQL Server Abuse", + "SSL Certificates with Punycode", + "Salat Stealer", "Salt Typhoon", "SamSam Ransomware", + "Samsam Test File Write", "Sandworm Tools", "Scattered Lapsus$ Hunters", "Scattered Spider", + "SchCache Change By App Connect And Create ADSI Object", + "Schedule Task with HTTP Command Arguments", + "Schedule Task with Rundll32 Command Trigger", + "Scheduled Task Creation on Remote Endpoint using At", + "Scheduled Task Deleted Or Created via CMD", + "Scheduled Task Initiation on Remote Endpoint", "Scheduled Tasks", + "Schtasks Run Task On Demand", + "Schtasks scheduling job on remote system", + "Schtasks used for forcing a reboot", + "Screensaver Event Trigger Execution", + "Script Execution via WMI", + "Sdclt UAC Bypass", + "Sdelete Application Execution", + "SearchProtocolHost with no Command Line with Network", "Seashell Blizzard", "Secret Blizzard", + "SecretDumps Offline NTDS Dumping Tool", "Security Solution Tampering", + "ServicePrincipalNames Discovery with PowerShell", + "ServicePrincipalNames Discovery with SetSPN", + "Services Escalate Exe", + "Services LOLBAS Execution Process Spawn", "SesameOp", + "Set Default PowerShell Execution Policy To Unrestricted or Bypass", + "Shai-Hulud 2 Exfiltration Artifact Files", + "Shai-Hulud Workflow File Creation or Modification", + "Shim Database File Creation", + "Shim Database Installation With Suspicious Parameters", + "Short Lived Scheduled Task", + "Short Lived Windows Accounts", "ShrinkLocker", "Signed Binary Proxy Execution InstallUtil", + "SilentCleanup UAC Bypass", "Silver Sparrow", + "Single Letter Process On Endpoint", "Snake Keylogger", "Snake Malware", "SnappyBee", "Sneaky Active Directory Persistence Tricks", "SolarWinds WHD RCE Post Exploitation", "Spearphishing Attachments", + "Spike in File Writes", "Splunk", + "Splunk App for Lookup File Editing RCE via User XSLT", "Splunk AppDynamics Secure Application Alert", + "Splunk AppDynamics Secure Application Alerts", + "Splunk Authentication Token Exposure in Debug Log", + "Splunk Code Injection via custom dashboard leading to RCE", "Splunk Common Information Model (CIM)", + "Splunk Enterprise KV Store Incorrect Authorization", + "Splunk Information Disclosure on Account Login", + "Splunk Path Traversal In Splunk App For Lookup File Edit", + "Splunk RCE PDFgen Render", + "Splunk RCE Through Arbitrary File Write to Windows System Root", + "Splunk RCE via User XSLT", + "Splunk Secure Application Alerts for Runtime Security", + "Splunk Sensitive Information Disclosure in DEBUG Logging Channels", "Splunk Stream HTTP", "Splunk Stream IP", "Splunk Stream TCP", + "Splunk User Enumeration Attempt", + "Splunk Vulnerabilities", + "Splunk XSS Privilege Escalation via Custom Urls in Dashboard", + "Spoolsv Spawning Rundll32", + "Spoolsv Suspicious Loaded Modules", + "Spoolsv Suspicious Process Access", + "Spoolsv Writing a DLL", + "Spoolsv Writing a DLL - Sysmon", "Spring4Shell CVE-2022-22965", + "Spring4Shell Payload URL Request", + "Sqlite Module In Temp Folder", + "Steal or Forge Authentication Certificates Behavior Identified", "StealC Stealer", "Storm-0501 Ransomware", "Storm-2460 CLFS Zero Day Exploitation", "Subvert Trust Controls SIP and Trust Provider Hijacking", + "Sunburst Correlation DLL and Network Event", + "Supernova Webshell", "Suricata", + "Suspicious AWS Bedrock Claude Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", @@ -511,22 +1755,59 @@ "Suspicious Cloud User Activities", "Suspicious Command-Line Executions", "Suspicious Compiled HTML Activity", + "Suspicious Computer Account Name Change", + "Suspicious Copy on System32", + "Suspicious Curl Network Connection", + "Suspicious DLLHost no Command Line Arguments", "Suspicious DNS Traffic", + "Suspicious Email Attachment Extensions", "Suspicious Emails", "Suspicious GCP Storage Activities", + "Suspicious GPUpdate no Command Line Arguments", + "Suspicious IcedID Rundll32 Cmdline", + "Suspicious Image Creation In Appdata Folder", + "Suspicious Java Classes", + "Suspicious Kerberos Service Ticket Request", + "Suspicious Linux Discovery Commands", "Suspicious Local LLM Frameworks", "Suspicious MCP Activities", + "Suspicious MSBuild Rename", + "Suspicious MSBuild Spawn", "Suspicious MSHTA Activity", "Suspicious Microsoft 365 Copilot Activities", "Suspicious Okta Activity", "Suspicious Ollama Activities", + "Suspicious PlistBuddy Usage", + "Suspicious PlistBuddy Usage via OSquery", + "Suspicious Process DNS Query Known Abuse Web Services", + "Suspicious Process Executed From Container File", + "Suspicious Process With Discord DNS Query", + "Suspicious Reg exe Process", "Suspicious Regsvcs Regasm Activity", "Suspicious Regsvr32 Activity", + "Suspicious Regsvr32 Register Suspicious Path", "Suspicious Rundll32 Activity", + "Suspicious Rundll32 PluginInit", + "Suspicious Rundll32 StartW", + "Suspicious Rundll32 dllregisterserver", + "Suspicious Rundll32 no Command Line Arguments", + "Suspicious SQLite3 LSQuarantine Behavior", + "Suspicious Scheduled Task from Public Directory", + "Suspicious SearchProtocolHost no Command Line Arguments", + "Suspicious Ticket Granting Ticket Request", "Suspicious User Agents", + "Suspicious WAV file in Appdata Folder", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Suspicious Zoom Child Processes", + "Suspicious microsoft workflow compiler rename", + "Suspicious microsoft workflow compiler usage", + "Suspicious msbuild path", + "Suspicious mshta child process", + "Suspicious mshta spawn", + "Suspicious wevtutil Usage", + "Suspicious writes to windows Recycle Bin", + "Svchost LOLBAS Execution Process Spawn", "Swift Slicer", "SysAid On-Prem Software CVE-2023-47246 Vulnerability", "Sysmon EventID 1", @@ -552,45 +1833,318 @@ "Sysmon EventID 9", "Sysmon for Linux EventID 1", "Sysmon for Linux EventID 11", + "System Info Gathering Using Dxdiag Application", + "System Information Discovery Detection", + "System Processes Run From Unexpected Locations", + "System User Discovery With Query", + "System User Discovery With Whoami", "SystemBC", + "TOR Traffic", "Telnetd CVE-2026-24061", "Termite Ransomware", "Text4Shell CVE-2022-42889", "Threat Activity by Snort IDs", + "Time Provider Persistence Registry", + "Tomcat Session Deserialization Attempt", + "Tomcat Session File Upload Attempt", "Trickbot", + "Trickbot Named Pipe", "Trusted Developer Utilities Proxy Execution", "Trusted Developer Utilities Proxy Execution MSBuild", "Tuoni", + "UAC Bypass MMC Load Unsigned Dll", + "UAC Bypass With Colorui COM Object", + "USN Journal Deletion", + "Uninstall App Using MsiExec", + "Unknown Process Using The Kerberos Protocol", + "Unload Sysmon Filter Driver", + "Unloading AMSI via Reflection", + "Unusual Number of Computer Service Tickets Requested", + "Unusual Number of Kerberos Service Tickets Requested", + "Unusual Number of Remote Endpoint Authentication Events", "Unusual Processes", + "Unusually Long Command Line", + "Unusually Long Content-Type Length", "Use of Cleartext Protocols", + "User Discovery With Env Vars PowerShell", + "User Discovery With Env Vars PowerShell Script Block", "VIP Keylogger", + "VMWare Aria Operations Exploit Attempt", "VMWare ESXi Syslog", "VMware Aria Operations vRealize CVE-2023-20887", "VMware ESXi AD Integration Authentication Bypass CVE-2024-37085", "VMware Server Side Injection and Privilege Escalation", + "VMware Server Side Template Injection Hunt", + "VMware Workspace ONE Freemarker Server-side Template Injection", "ValleyRAT", "VanHelsing Ransomware", + "Vbscript Execution Using Wscript App", + "Verclsid CLSID Execution", "Void Manticore", "VoidLink Cloud-Native Linux Malware", "Volt Typhoon", + "WBAdmin Delete System Backups", + "WMI Permanent Event Subscription", + "WMI Permanent Event Subscription - Sysmon", + "WMI Recon Running Process Or Services", + "WMI Temporary Event Subscription", + "WMIC XSL Execution via URL", + "WS FTP Remote Code Execution", "WS FTP Server Critical Vulnerabilities", + "WSReset UAC Bypass", "Warzone RAT", "Water Gamayun", + "Wbemprox COM Object Execution", + "Web JSP Request via URL", + "Web Remote ShellServlet Access", + "Web Servers Executing Suspicious Processes", + "Web Spring Cloud Function FunctionRouter", + "Web Spring4Shell HTTP Request Class Module", + "Web or Application Server Spawning a Shell", + "Wermgr Process Connecting To IP Check Web Services", + "Wermgr Process Create Executable File", + "Wermgr Process Spawned CMD Or Powershell Process", "WhisperGate", "WinDealer RAT", + "WinEvent Scheduled Task Created Within Public Path", + "WinEvent Scheduled Task Created to Spawn Shell", + "WinEvent Windows Task Scheduler Event Action Started", + "WinRAR Spawning Shell Application", "WinRAR Spoofing Attack CVE-2023-38831", + "WinRM Spawning a Process", + "Windchill Log4j", + "Windows .Key File Creation in Root Directory", + "Windows AD Abnormal Object Access Activity", + "Windows AD AdminSDHolder ACL Modified", + "Windows AD Cross Domain SID History Addition", + "Windows AD DCShadow Privileges ACL Addition", + "Windows AD DSRM Account Changes", + "Windows AD DSRM Password Reset", + "Windows AD Dangerous Deny ACL Modification", + "Windows AD Dangerous Group ACL Modification", + "Windows AD Dangerous User ACL Modification", + "Windows AD Domain Controller Audit Policy Disabled", + "Windows AD Domain Controller Promotion", + "Windows AD Domain Replication ACL Addition", + "Windows AD Domain Root ACL Deletion", + "Windows AD Domain Root ACL Modification", + "Windows AD GPO Deleted", + "Windows AD GPO Disabled", + "Windows AD GPO New CSE Addition", + "Windows AD Hidden OU Creation", + "Windows AD Object Owner Updated", + "Windows AD Privileged Account SID History Addition", + "Windows AD Privileged Group Modification", + "Windows AD Privileged Object Access Activity", + "Windows AD Replication Request Initiated by User Account", + "Windows AD Replication Request Initiated from Unsanctioned Location", + "Windows AD Replication Service Traffic", + "Windows AD Rogue Domain Controller Network Activity", + "Windows AD SID History Attribute Modified", + "Windows AD Same Domain SID History Addition", + "Windows AD Self DACL Assignment", + "Windows AD ServicePrincipalName Added To Domain Account", + "Windows AD Short Lived Domain Account ServicePrincipalName", + "Windows AD Short Lived Domain Controller SPN Attribute", + "Windows AD Short Lived Server Object", + "Windows AD Suspicious Attribute Modification", + "Windows AD add Self to Group", + "Windows AI Platform DNS Query", + "Windows Abused Web Services", + "Windows Access Token Manipulation SeDebugPrivilege", + "Windows Access Token Manipulation Winlogon Duplicate Token Handle", + "Windows Access Token Winlogon Duplicate Handle In Uncommon Path", + "Windows Account Access Removal via Logoff Exec", + "Windows Account Discovery With NetUser PreauthNotRequire", + "Windows Account Discovery for None Disable User Account", + "Windows Account Discovery for Sam Account Name", "Windows Active Directory Admon", + "Windows AdFind Exe", + "Windows Admin Password Changed by Non-Admin", + "Windows Admin Permission Discovery", + "Windows Administrative Shares Accessed On Multiple Hosts", + "Windows Admon Default Group Policy Object Modified", + "Windows Admon Group Policy Object Created", + "Windows Advanced Installer MSIX with AI_STUBS Execution", + "Windows Alternate DataStream - Base64 Content", + "Windows Alternate DataStream - Executable Content", + "Windows Alternate DataStream - Process Execution", + "Windows Anomalous Registry Value Length in Environment Key", + "Windows Anonymous Pipe Activity", + "Windows Apache Benchmark Binary", + "Windows App Layer Protocol Qakbot NamedPipe", + "Windows App Layer Protocol Wermgr Connect To NamedPipe", + "Windows AppCertDLL Modification Via Command Line", "Windows AppLocker", + "Windows AppLocker Block Events", + "Windows AppLocker Execution from Uncommon Locations", + "Windows AppLocker Privilege Escalation via Unauthorized Bypass", + "Windows AppLocker Rare Application Launch Detection", + "Windows AppX Deployment Full Trust Package Installation", + "Windows AppX Deployment Package Installation Success", + "Windows AppX Deployment Unsigned Package Installation", + "Windows Application Layer Protocol RMS Radmin Tool Namedpipe", + "Windows Application Whitelisting Bypass Attempt via Rundll32", + "Windows Archive Collected Data via Powershell", + "Windows Archive Collected Data via Rar", + "Windows Archived Collected Data In TEMP Folder", "Windows Attack Surface Reduction", + "Windows Attempt To Stop Security Service", + "Windows Audit Policy Auditing Option Disabled via Auditpol", + "Windows Audit Policy Auditing Option Modified - Registry", + "Windows Audit Policy Cleared via Auditpol", + "Windows Audit Policy Disabled via Auditpol", + "Windows Audit Policy Disabled via Legacy Auditpol", + "Windows Audit Policy Excluded Category via Auditpol", + "Windows Audit Policy Restored via Auditpol", + "Windows Audit Policy Security Descriptor Tampering via Auditpol", "Windows Audit Policy Tampering", + "Windows AutoIt3 Execution", + "Windows Autostart Execution LSASS Driver Registry Modification", + "Windows Azure PowerShell Module Installation Via PowerShell Script", + "Windows Azure Storage Utility Execution Via CLI", + "Windows Binary Execution from an Archive", + "Windows Binary Proxy Execution Mavinject DLL Injection", + "Windows BitDefender Submission Wizard DLL Sideloading", + "Windows BitLocker Suspicious Command Usage", + "Windows BitLockerToGo Process Execution", + "Windows BitLockerToGo with Network Activity", + "Windows Bluetooth Service Installed From Uncommon Location", + "Windows Boot or Logon Autostart Execution In Startup Folder", "Windows BootKits", + "Windows BootLoader Inventory", + "Windows Browser Process Launched with Unusual Flags", + "Windows Bypass UAC via Pkgmgr Tool", + "Windows CAB File on Disk", + "Windows COM Hijacking InprocServer32 Modification", + "Windows Cabinet File Extraction Via Expand", + "Windows Cached Domain Credentials Reg Query", "Windows Certificate Services", + "Windows Certutil Root Certificate Addition", + "Windows Change File Association Command To Notepad", + "Windows Chrome Auto-Update Disabled via Registry", + "Windows Chrome Enable Extension Loading via Command-Line", + "Windows Chrome Extension Allowed Registry Modification", + "Windows Chromium Browser Launched with Small Window Size", + "Windows Chromium Browser No Security Sandbox Process", + "Windows Chromium Browser with Custom User Data Directory", + "Windows Chromium Process Launched with Logging Disabled", + "Windows Chromium Process Loaded Extension via Command-Line", + "Windows Chromium Process with Disabled Extensions", + "Windows Chromium process Launched with Disable Popup Blocking", + "Windows Cisco Secure Endpoint Related Service Stopped", + "Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc", + "Windows Cisco Secure Endpoint Unblock File Via Sfc", + "Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc", + "Windows ClipBoard Data via Get-ClipBoard", + "Windows Cloud Files Filter Loaded by Uncommon Process", + "Windows Cloud Files Filter Log Created by Non-System Process", + "Windows Cmdline Tool Execution From Non-Shell Process", + "Windows Cobalt Strike PowerShell Loader", + "Windows Command Obfuscation with Environment Variable Substrings", + "Windows Command Shell DCRat ForkBomb Payload", + "Windows Command and Scripting Interpreter Hunting Path Traversal", + "Windows Command and Scripting Interpreter Path Traversal Exec", + "Windows Common Abused Cmd Shell Risk Behavior", + "Windows Compatibility Telemetry Suspicious Child Process", + "Windows Compatibility Telemetry Tampering Through Registry", + "Windows Computer Account Changed to Domain Controller", + "Windows Computer Account Created by Computer Account", + "Windows Computer Account Requesting Kerberos Ticket", + "Windows Computer Account With SPN", + "Windows ComputerDefaults Spawning a Process", + "Windows ConHost with Headless Argument", + "Windows ConsoleHost History File Deletion", + "Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script", + "Windows Create Local Account", + "Windows Create Local Administrator Account Via Net", + "Windows Credential Access From Browser Password Store", + "Windows Credential Dumping LSASS Memory Createdump", + "Windows Credential Target Information Structure in Commandline", + "Windows Credentials Access via VaultCli Module", + "Windows Credentials from Password Stores Chrome Copied in TEMP Dir", + "Windows Credentials from Password Stores Chrome Extension Access", + "Windows Credentials from Password Stores Chrome LocalState Access", + "Windows Credentials from Password Stores Chrome Login Data Access", + "Windows Credentials from Password Stores Creation", + "Windows Credentials from Password Stores Deletion", + "Windows Credentials from Password Stores Query", + "Windows Credentials from Web Browsers Saved in TEMP Folder", + "Windows Credentials in Registry Reg Query", + "Windows CrowdStrike Agent Registry Key Removal", + "Windows Crowdstrike RTR Script Execution", + "Windows Curl Download to Suspicious Path", + "Windows Curl Upload to Remote Destination", + "Windows DISM Install PowerShell Web Access", + "Windows DISM Remove Defender", + "Windows DLL Module Loaded in Temp Dir", + "Windows DLL Search Order Hijacking Hunt with Sysmon", + "Windows DLL Search Order Hijacking with iscsicpl", + "Windows DLL Side-Loading In Calc", + "Windows DLL Side-Loading Process Child Of Calc", + "Windows DNS Gather Network Info", + "Windows DNS Query Request To TinyUrl", + "Windows DNS Query Request by Telegram Bot API", "Windows DNS SIGRed CVE-2020-1350", + "Windows Data Destruction Recursive Exec Files Deletion", + "Windows Debugger Tool Execution", + "Windows Defacement Modify Transcodedwallpaper File", + "Windows Default Cobalt Strike PowerShell Beacon", + "Windows Default Group Policy Object Modified", + "Windows Default Group Policy Object Modified with GPME", + "Windows Default RDP File Creation By Non MSTSC Process", + "Windows Default Rdp File Deletion", + "Windows Default Rdp File Unhidden", + "Windows Defender ASR Audit Events", + "Windows Defender ASR Block Events", + "Windows Defender ASR Registry Modification", + "Windows Defender ASR Rule Disabled", + "Windows Defender ASR Rules Stacking", + "Windows Defender ASR or Threat Configuration Tamper", "Windows Defender Alerts", + "Windows Defender Exclusion Registry Entry", "Windows Defense Evasion Tactics", + "Windows Delete or Modify System Firewall", + "Windows Deleted Registry By A Non Critical Process File Path", + "Windows Detect Network Scanner Behavior", + "Windows Developer-Signed MSIX Package Installation", + "Windows Devtunnels Execution", + "Windows Devtunnels Image Loaded", + "Windows Disable Change Password Through Registry", + "Windows Disable Internet Explorer Addons", + "Windows Disable Lock Workstation Feature Through Registry", + "Windows Disable LogOff Button Through Registry", + "Windows Disable Memory Crash Dump", + "Windows Disable Notification Center", + "Windows Disable Shutdown Button Through Registry", + "Windows Disable Windows Event Logging Disable HTTP Logging", + "Windows Disable Windows Group Policy Features Through Registry", + "Windows Disable or Modify Tools Via Taskkill", + "Windows Disable or Stop Browser Process", + "Windows DisableAntiSpyware Registry", "Windows Discovery Techniques", + "Windows DiskCryptor Usage", + "Windows Diskshadow Proxy Execution", + "Windows DnsAdmins New Member Added", + "Windows Domain Account Discovery Via Get-NetComputer", + "Windows Domain Admin Impersonation Indicator", + "Windows DotNet Binary in Non Standard Path", + "Windows Downdate Registry Activity", + "Windows Driver Inventory", + "Windows Driver Load Non-Standard Path", "Windows Drivers", + "Windows Drivers Loaded by Signature", + "Windows EDRSilencer Execution", + "Windows EFI Bootloader File Modification", + "Windows EFI Volume Mount Attempt Via Mountvol", + "Windows ESX Admins Group Creation Security Event", + "Windows ESX Admins Group Creation via Net", + "Windows ESX Admins Group Creation via PowerShell", + "Windows Enable PowerShell Web Access", + "Windows Enable Win32 ScheduledJob via Registry", + "Windows Entra User Management Via Azure CLI", "Windows Error Reporting Service Elevation of Privilege Vulnerability", + "Windows Event For Service Disabled", "Windows Event Log AppXDeployment-Server 400", "Windows Event Log AppXDeployment-Server 854", "Windows Event Log AppXDeployment-Server 855", @@ -603,6 +2157,7 @@ "Windows Event Log CAPI2 70", "Windows Event Log CAPI2 81", "Windows Event Log CertificateServicesClient 1007", + "Windows Event Log Cleared", "Windows Event Log Defender 1121", "Windows Event Log Defender 1122", "Windows Event Log Defender 1125", @@ -635,6 +2190,7 @@ "Windows Event Log Security 4703", "Windows Event Log Security 4719", "Windows Event Log Security 4720", + "Windows Event Log Security 4723", "Windows Event Log Security 4724", "Windows Event Log Security 4725", "Windows Event Log Security 4726", @@ -682,29 +2238,609 @@ "Windows Event Log System 7045", "Windows Event Log TaskScheduler 200", "Windows Event Log TaskScheduler 201", + "Windows Event Logging Service Has Shutdown", + "Windows Event Triggered Image File Execution Options Injection", + "Windows EventLog Recon Activity Using Log Query Utilities", + "Windows Eventlog Cleared Via Wevtutil", + "Windows Excel Spawning Microsoft Project Application", + "Windows Excessive Disabled Services Event", + "Windows Excessive Service Stop Attempt", + "Windows Excessive Usage Of Net App", + "Windows Exchange Autodiscover SSRF Abuse", + "Windows Executable Masquerading as Benign File Types", + "Windows Executable in Loaded Modules", + "Windows Execute Arbitrary Commands with MSDT", + "Windows Execution of Microsoft MSC File In Suspicious Path", + "Windows Exfiltration Over C2 Via Invoke RestMethod", + "Windows Exfiltration Over C2 Via Powershell UploadString", + "Windows Explorer LNK Exploit Process Launch With Padding", + "Windows Explorer.exe Spawning PowerShell or Cmd", + "Windows Export Certificate", + "Windows FFmpeg Audio and Video Device Discovery", + "Windows FFmpeg DirectShow Video Capture", + "Windows File Association Modification via Ftype", + "Windows File Collection Via Copy Utilities", + "Windows File Download Via CertUtil", + "Windows File Download Via PowerShell", "Windows File Extension and Association Abuse", + "Windows File Share Discovery With Powerview", + "Windows File Transfer Protocol In Non-Common Process Path", + "Windows File Without Extension In Critical Folder", + "Windows File and Directory Enable ReadOnly Permissions", + "Windows File and Directory Permissions Enable Inheritance", + "Windows File and Directory Permissions Remove Inheritance", + "Windows Files and Dirs Access Rights Modification Via Icacls", + "Windows Filtering Platform Policy Added to Block EDR Process", + "Windows Find Domain Organizational Units with GetDomainOU", + "Windows Find Interesting ACL with FindInterestingDomainAcl", + "Windows Findstr GPP Discovery", + "Windows Firewall Rule Added", + "Windows Firewall Rule Deletion", + "Windows Firewall Rule Modification", + "Windows Forest Discovery with GetForestDomain", + "Windows Gather Victim Host Information Camera", + "Windows Gather Victim Identity SAM Info", + "Windows Gather Victim Network Info Through Ip Check Web Services", + "Windows Gdrive Binary Activity", + "Windows Get Local Admin with FindLocalAdminAccess", + "Windows Get-AdComputer Unconstrained Delegation Discovery", + "Windows Get-Variable.EXE Execution from WindowsApps Folder", + "Windows Global Object Access Audit List Cleared Via Auditpol", + "Windows GrimResource - MMC Process Accessing APDS DLL", + "Windows Group Discovery Via Net", + "Windows Group Policy Object Created", + "Windows Guest Account Enabled Via Net.EXE", + "Windows HTTP Network Communication From MSIExec", + "Windows Handle Duplication in Known UAC-Bypass Binaries", + "Windows Hidden Schedule Task Settings", + "Windows Hide Notification Features Through Registry", + "Windows High File Deletion Frequency", + "Windows Hijack Execution Flow Version Dll Side Load", + "Windows Hosts File Access", + "Windows Hunting System Account Targeting Lsass", "Windows IIS", "Windows IIS 29", + "Windows IIS Components Add New Module", + "Windows IIS Components Get-WebGlobalModule Module Query", + "Windows IIS Components Module Failed to Load", + "Windows IIS Components New Module Added", + "Windows IIS Server PSWA Console Access", + "Windows IOBit Unlocker Extension DLL Registration via Regsvr32", + "Windows ISO LNK File Creation", + "Windows Identify PowerShell Web Access IIS Pool", + "Windows Identify Protocol Handlers", + "Windows Impair Defense Add Xml Applocker Rules", + "Windows Impair Defense Change Win Defender Health Check Intervals", + "Windows Impair Defense Change Win Defender Quick Scan Interval", + "Windows Impair Defense Change Win Defender Throttle Rate", + "Windows Impair Defense Change Win Defender Tracing Level", + "Windows Impair Defense Configure App Install Control", + "Windows Impair Defense Define Win Defender Threat Action", + "Windows Impair Defense Delete Win Defender Context Menu", + "Windows Impair Defense Delete Win Defender Profile Registry", + "Windows Impair Defense Deny Security Software With Applocker", + "Windows Impair Defense Disable Controlled Folder Access", + "Windows Impair Defense Disable Defender Firewall And Network", + "Windows Impair Defense Disable Defender Protocol Recognition", + "Windows Impair Defense Disable PUA Protection", + "Windows Impair Defense Disable Realtime Signature Delivery", + "Windows Impair Defense Disable Web Evaluation", + "Windows Impair Defense Disable Win Defender App Guard", + "Windows Impair Defense Disable Win Defender Compute File Hashes", + "Windows Impair Defense Disable Win Defender Gen reports", + "Windows Impair Defense Disable Win Defender Network Protection", + "Windows Impair Defense Disable Win Defender Report Infection", + "Windows Impair Defense Disable Win Defender Scan On Update", + "Windows Impair Defense Disable Win Defender Signature Retirement", + "Windows Impair Defense Overide Win Defender Phishing Filter", + "Windows Impair Defense Override SmartScreen Prompt", + "Windows Impair Defense Set Win Defender Smart Screen Level To Warn", + "Windows Impair Defenses Disable AV AutoStart via Registry", + "Windows Impair Defenses Disable Auto Logger Session", + "Windows Impair Defenses Disable HVCI", + "Windows Impair Defenses Disable Win Defender Auto Logging", + "Windows Important Audit Policy Disabled", + "Windows InProcServer32 New Outlook Form", + "Windows Increase in Group or Object Modification Activity", + "Windows Increase in User Modification Activity", + "Windows Indicator Removal Via Rmdir", + "Windows Indirect Command Execution Via Series Of Forfiles", + "Windows Indirect Command Execution Via forfiles", + "Windows Indirect Command Execution Via pcalua", + "Windows Information Discovery Fsutil", + "Windows Ingress Tool Transfer Using Explorer", + "Windows Input Capture Using Credential UI Dll", + "Windows InstallUtil Credential Theft", + "Windows InstallUtil Remote Network Connection", + "Windows InstallUtil URL in Command Line", + "Windows InstallUtil Uninstall Option", + "Windows InstallUtil in Non Standard Path", + "Windows Kerberos Coercion via DNS", + "Windows Kerberos Local Successful Logon", + "Windows Known Abused DLL Created", + "Windows Known Abused DLL Loaded Suspiciously", + "Windows Known GraphicalProton Loaded Modules", + "Windows KrbRelayUp Service Creation", + "Windows LAPS Password Gathering Via PowerShell Script", + "Windows LOLBAS Executed As Renamed File", + "Windows LOLBAS Executed Outside Expected Path", + "Windows LSA Secrets NoLMhash Registry", + "Windows Large Number of Computer Service Tickets Requested", + "Windows Ldifde Directory Object Behavior", + "Windows Level RMM PowerShell Script Installer", + "Windows Level RMM Watchdog Task Created", + "Windows Linked Policies In ADSI Discovery", + "Windows List ENV Variables Via SET Command From Uncommon Parent", + "Windows Local Administrator Credential Stuffing", + "Windows Local LLM Framework Execution", "Windows Log Manipulation", + "Windows MMC Loaded Script Engine DLL", + "Windows MOF Event Triggered Execution via WMI", + "Windows MOVEit Transfer Writing ASPX", + "Windows MSC EvilTwin Directory Path Manipulation", + "Windows MSExchange Management Mailbox Cmdlet Usage", + "Windows MSHTA Writing to World Writable Path", + "Windows MSI Rollback Script Deleted By Non-Msiexec Process", + "Windows MSIExec DLLRegisterServer", + "Windows MSIExec Remote Download", + "Windows MSIExec Spawn Discovery Command", + "Windows MSIExec Spawn WinDBG", + "Windows MSIExec Unregister DLLRegisterServer", + "Windows MSIX Package Interaction", + "Windows MSTSC RDP Commandline", + "Windows Mail Protocol In Non-Common Process Path", + "Windows Mark Of The Web Bypass", + "Windows Masquerading Explorer As Child Process", + "Windows Masquerading Msdtc Process", + "Windows Metasploit Confluence Plugin Execution", + "Windows Mimikatz Binary Execution", + "Windows Mimikatz Crypto Export File Extensions", + "Windows Mock Trusted Directory MSC File Creation", + "Windows Modify Registry AuthenticationLevelOverride", + "Windows Modify Registry Auto Minor Updates", + "Windows Modify Registry Auto Update Notif", + "Windows Modify Registry Configure BitLocker", + "Windows Modify Registry Default Icon Setting", + "Windows Modify Registry Delete Firewall Rules", + "Windows Modify Registry DisAllow Windows App", + "Windows Modify Registry Disable RDP", + "Windows Modify Registry Disable Restricted Admin", + "Windows Modify Registry Disable Toast Notifications", + "Windows Modify Registry Disable Win Defender Raw Write Notif", + "Windows Modify Registry Disable WinDefender Notifications", + "Windows Modify Registry Disable Windows Security Center Notif", + "Windows Modify Registry DisableRemoteDesktopAntiAlias", + "Windows Modify Registry DisableSecuritySettings", + "Windows Modify Registry Disabling WER Settings", + "Windows Modify Registry Do Not Connect To Win Update", + "Windows Modify Registry DontShowUI", + "Windows Modify Registry EnableLinkedConnections", + "Windows Modify Registry LongPathsEnabled", + "Windows Modify Registry MaxConnectionPerServer", + "Windows Modify Registry No Auto Reboot With Logon User", + "Windows Modify Registry No Auto Update", + "Windows Modify Registry NoChangingWallPaper", + "Windows Modify Registry ProxyEnable", + "Windows Modify Registry ProxyServer", + "Windows Modify Registry Qakbot Binary Data Registry", + "Windows Modify Registry Regedit Silent Reg Import", + "Windows Modify Registry Risk Behavior", + "Windows Modify Registry Suppress Win Defender Notif", + "Windows Modify Registry Tamper Protection", + "Windows Modify Registry USeWuServer", + "Windows Modify Registry UpdateServiceUrlAlternate", + "Windows Modify Registry Utilize ProgIDs", + "Windows Modify Registry ValleyRAT C2 Config", + "Windows Modify Registry ValleyRat PWN Reg Entry", + "Windows Modify Registry With MD5 Reg Key Name", + "Windows Modify Registry WuServer", + "Windows Modify Registry on Smart Card Group Policy", + "Windows Modify Registry to Add or Modify Firewall Rule", + "Windows Modify Registry wuStatusServer", + "Windows Modify Show Compress Color And Info Tip Registry", + "Windows Modify System Firewall with Notable Process Path", + "Windows MpCmdRun RemoveDefinitions Execution", + "Windows MsMpEng Writing to System32", + "Windows Mshta Execution In Registry", + "Windows MsiExec HideWindow Rundll32 Execution", + "Windows Multi hop Proxy TOR Website Query", + "Windows Multiple Account Passwords Changed", + "Windows Multiple Accounts Deleted", + "Windows Multiple Accounts Disabled", + "Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos", + "Windows Multiple Invalid Users Fail To Authenticate Using Kerberos", + "Windows Multiple Invalid Users Failed To Authenticate Using NTLM", + "Windows Multiple NTLM Null Domain Authentications", + "Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials", + "Windows Multiple Users Failed To Authenticate From Host Using NTLM", + "Windows Multiple Users Failed To Authenticate From Process", + "Windows Multiple Users Failed To Authenticate Using Kerberos", + "Windows Multiple Users Remotely Failed To Authenticate From Host", + "Windows Mustang Panda USB Tool Execution", + "Windows Net System Service Discovery", + "Windows NetSupport RMM DLL Loaded By Uncommon Process", + "Windows Netspy Network Scanner Execution", + "Windows Network Connection Discovery Via Net", + "Windows Network Connection From Program In Suspect Location", + "Windows Network Share Interaction Via Net", + "Windows New Custom Security Descriptor Set On EventLog Channel", + "Windows New Default File Association Value Set", + "Windows New Deny Permission Set On Service SD Via Sc.EXE", + "Windows New EventLog ChannelAccess Registry Value Set", + "Windows New InProcServer32 Added", + "Windows New Service Security Descriptor Set Via Sc.EXE", + "Windows Ngrok Reverse Proxy Usage", + "Windows NirSoft AdvancedRun", + "Windows NirSoft Tool Bundle File Created", + "Windows NirSoft Utilities", + "Windows Njrat Fileless Storage via Registry", + "Windows Non Discord App Access Discord LevelDB", + "Windows Non-System Account Targeting Lsass", + "Windows Non-System Process Querying Definition Update", + "Windows NorthStar C2 Agent Execution", + "Windows Obfuscated Files or Information via RAR SFX", + "Windows Odbcconf Hunting", + "Windows Odbcconf Load DLL", + "Windows Odbcconf Load Response File", + "Windows Office Product Dropped Cab or Inf File", + "Windows Office Product Dropped Uncommon File", + "Windows Office Product Loaded MSHTML Module", + "Windows Office Product Loading Taskschd DLL", + "Windows Office Product Loading VBE7 DLL", + "Windows Office Product Spawned Child Process For Download", + "Windows Office Product Spawned Control", + "Windows Office Product Spawned MSDT", + "Windows Office Product Spawned Rundll32 With No DLL", + "Windows Office Product Spawned Uncommon Process", + "Windows OneDrive Share Mounted via Net", + "Windows Outlook Dialogs Disabled from Unusual Process", + "Windows Outlook LoadMacroProviderOnBoot Persistence", + "Windows Outlook Macro Created by Suspicious Process", + "Windows Outlook Macro Security Modified", + "Windows Outlook WebView Registry Modification", + "Windows PUA Named Pipe", + "Windows PaperCut NG Spawn Shell", + "Windows Parent PID Spoofing with Explorer", + "Windows Password Managers Discovery", + "Windows Password Policy Discovery with Net", "Windows Persistence Techniques", + "Windows Phishing Outlook Drop Dll In FORM Dir", + "Windows Phishing PDF File Executes URL Link", + "Windows Phishing Recent ISO Exec Registry", + "Windows Possible Credential Dumping", + "Windows Post Exploitation Risk Behavior", "Windows Post-Exploitation", + "Windows Potato Privilege Escalation Tool Execution", + "Windows Potential AppDomainManager Hijack Artifacts Creation", + "Windows Potential Cloudflared Network Connection", + "Windows Potential Cloudflared Tunnel Execution", + "Windows Potential Web Shell Creation For VMware Workspace ONE", + "Windows PowGoop Beacon Decoding", + "Windows PowerShell Add Module to Global Assembly Cache", + "Windows PowerShell Disable HTTP Logging", + "Windows PowerShell Export Certificate", + "Windows PowerShell Export PfxCertificate", + "Windows PowerShell FakeCAPTCHA Clipboard Execution", + "Windows PowerShell Get CIMInstance Remote Computer", + "Windows PowerShell IIS Components WebGlobalModule Usage", + "Windows PowerShell Invoke-RestMethod IP Information Collection", + "Windows PowerShell Invoke-Sqlcmd Execution", + "Windows PowerShell MSIX Package Installation", + "Windows PowerShell Module File Created", + "Windows PowerShell Process Implementing Manual Base64 Decoder", + "Windows PowerShell Process With Malicious String", + "Windows PowerShell ScheduleTask", + "Windows PowerShell Script Block With Malicious String", + "Windows PowerShell Script From WindowsApps Directory", + "Windows PowerShell Script TabExpansion Direct Call", + "Windows PowerShell WMI Win32 ScheduledJob", + "Windows PowerSploit GPP Discovery", + "Windows PowerView AD Access Control List Enumeration", + "Windows PowerView Constrained Delegation Discovery", + "Windows PowerView Kerberos Service Ticket Request", + "Windows PowerView SPN Discovery", + "Windows PowerView Unconstrained Delegation Discovery", + "Windows Powershell Cryptography Namespace", + "Windows Powershell History File Deletion", + "Windows Powershell Import Applocker Policy", + "Windows Powershell Logoff User via Quser", + "Windows Powershell RemoteSigned File", + "Windows Private Keys Discovery", "Windows Privilege Escalation", + "Windows Privilege Escalation Attempt Via MSI Rollback", + "Windows Privilege Escalation Suspicious Process Elevation", + "Windows Privilege Escalation System Process Without System Parent", + "Windows Privilege Escalation User Process Spawn System Process", + "Windows Privileged Group Modification", + "Windows Process Accessing Windows Recall Directory", + "Windows Process Commandline Discovery", + "Windows Process Executed From Removable Media", + "Windows Process Execution From ProgramData", + "Windows Process Execution From RDP Share", + "Windows Process Execution in Temp Dir", + "Windows Process Injection In Non-Service SearchIndexer", + "Windows Process Injection Remote Thread", + "Windows Process Injection Wermgr Child Process", + "Windows Process Injection With Public Source Path", + "Windows Process Injection into Commonly Abused Processes", + "Windows Process Injection into Notepad", + "Windows Process With NamedPipe CommandLine", + "Windows Process With NetExec Command Line Parameters", + "Windows Process Writing File to World Writable Path", + "Windows Processes Killed By Industroyer2 Malware", + "Windows Product Key Registry Query", + "Windows Protocol Tunneling with Plink", + "Windows Proxy Execution of .NET Utilities via Scripts", + "Windows Proxy Via Netsh", + "Windows Proxy Via Registry", + "Windows PsTools Recon Usage", + "Windows PuTTY Suite Utility Execution", + "Windows Query Registry Browser List Application", + "Windows Query Registry UnInstall Program List", "Windows RDP Artifacts and Defense Evasion", + "Windows RDP Bitmap Cache File Creation", + "Windows RDP Cache File Deletion", + "Windows RDP Client Launched with Admin Session", + "Windows RDP Connection Successful", + "Windows RDP File Execution", + "Windows RDP Login Session Was Established", + "Windows RDP Server Registry Deletion", + "Windows RDP Server Registry Entry Created", + "Windows RDPClient Connection Sequence Events", + "Windows RMM Named Pipe", + "Windows RMM Tool Execution", + "Windows Raccine Scheduled Task Deletion", + "Windows Rapid Authentication On Multiple Hosts", + "Windows Rasautou DLL Execution", + "Windows Raw Access To Disk Volume Partition", + "Windows Raw Access To Master Boot Record Drive", + "Windows Rdp AutomaticDestinations Deletion", "Windows Registry Abuse", + "Windows Registry BootExecute Modification", + "Windows Registry Certificate Added", + "Windows Registry Delete Task SD", + "Windows Registry Dotnet ETW Disabled Via ENV Variable", + "Windows Registry Entries Exported Via Reg", + "Windows Registry Entries Restored Via Reg", + "Windows Registry Modification for Safe Mode Persistence", + "Windows Registry Payload Injection", + "Windows Registry SIP Provider Modification", + "Windows Regsvr32 Renamed Binary", + "Windows Remote Access Software BRC4 Loaded Dll", + "Windows Remote Access Software RMS Registry", + "Windows Remote Assistance Spawning Process", + "Windows Remote Create Service", + "Windows Remote Desktop Network Bruteforce Attempt", + "Windows Remote Host Computer Management Access", + "Windows Remote Image Load", + "Windows Remote Management Execute Shell", + "Windows Remote Service Rdpwinst Tool Execution", + "Windows Remote Services Allow Rdp In Firewall", + "Windows Remote Services Allow Remote Assistance", + "Windows Remote Services Rdp Enable", + "Windows Renamed Powershell Execution", + "Windows Replication Through Removable Media", + "Windows Root Domain linked policies Discovery", + "Windows Routing and Remote Access Service Registry Key Change", + "Windows RunMRU Command Execution", + "Windows RunMRU Registry Key or Value Deleted", + "Windows Rundll32 Apply User Settings Changes", + "Windows Rundll32 Execution With Log.DLL", + "Windows Rundll32 Load DLL in Temp Dir", + "Windows Rundll32 WebDAV Request", + "Windows Rundll32 WebDav With Network Connection", + "Windows Rundll32 with Non-Standard File Extension", + "Windows SIP Provider Inventory", + "Windows SIP WinVerifyTrust Failed Trust Validation", + "Windows SOAPHound Binary Execution", + "Windows SQL Server Configuration Option Hunt", + "Windows SQL Server Critical Procedures Enabled", + "Windows SQL Server Extended Procedure DLL Loading Hunt", + "Windows SQL Server Startup Procedure", + "Windows SQL Server xp_cmdshell Config Change", + "Windows SQL Spawning CertUtil", + "Windows SQLCMD Execution", + "Windows SSH Proxy Command", + "Windows ScManager Security Descriptor Tampering Via Sc.EXE", + "Windows Scheduled Task Created Via XML", + "Windows Scheduled Task Created in a Group Policy Object", + "Windows Scheduled Task DLL Module Loaded", + "Windows Scheduled Task Service Spawned Shell", + "Windows Scheduled Task with Highest Privileges", + "Windows Scheduled Task with Suspicious Command", + "Windows Scheduled Task with Suspicious Name", + "Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr", + "Windows Schtasks Create Run As System", + "Windows Screen Capture Via Powershell", + "Windows Screen Capture in TEMP folder", + "Windows Security Account Manager Stopped", + "Windows Security And Backup Services Stop", + "Windows Security Support Provider Reg Query", + "Windows Sensitive Group Discovery With Net", + "Windows Sensitive Registry Hive Dump Via CommandLine", + "Windows Server Software Component GACUtil Install to GAC", "Windows Service Abuse", + "Windows Service Create Kernel Mode Driver", + "Windows Service Create RemComSvc", + "Windows Service Create SliverC2", + "Windows Service Create with Tscon", + "Windows Service Created with Suspicious Service Name", + "Windows Service Created with Suspicious Service Path", + "Windows Service Creation Using Registry Entry", + "Windows Service Creation on Remote Endpoint", + "Windows Service Deletion In Registry", + "Windows Service Execution RemCom", + "Windows Service Initiation on Remote Endpoint", + "Windows Service Stop Attempt", + "Windows Service Stop By Deletion", + "Windows Service Stop Win Updates", + "Windows Set Account Password Policy To Unlimited Via Net", + "Windows Set Custom DNS ServerLevelPlugin Via Dnscmd", + "Windows Set Network Profile Category to Private via Registry", + "Windows SharePoint Spinstall0 GET Request", + "Windows SharePoint Spinstall0 Webshell File Creation", + "Windows SharePoint ToolPane Endpoint Exploitation Attempt", + "Windows Shell Process from CrushFTP", + "Windows Shell or Script Execution From IIS Directory", + "Windows Short Lived DNS Record", + "Windows Snake Malware File Modification Crmlog", + "Windows Snake Malware Kernel Driver Comadmin", + "Windows Snake Malware Registry Modification wav OpenWithProgIds", + "Windows Snake Malware Service Create", + "Windows SnappyBee Create Test Registry", + "Windows SoftEther VPN Masquerading as Legitimate Binary", + "Windows Software Discovery Via PowerShell", + "Windows Spearphishing Attachment Connect To None MS Office Domain", + "Windows Spearphishing Attachment Onenote Spawn Mshta", + "Windows Special Privileged Logon On Multiple Hosts", + "Windows SpeechRuntime COM Hijacking DLL Load", + "Windows SpeechRuntime Suspicious Child Process", + "Windows SqlWriter SQLDumper DLL Sideload", + "Windows Sqlservr Spawning Shell", + "Windows Steal Authentication Certificates - ESC1 Abuse", + "Windows Steal Authentication Certificates - ESC1 Authentication", + "Windows Steal Authentication Certificates CS Backup", + "Windows Steal Authentication Certificates CertUtil Backup", + "Windows Steal Authentication Certificates Certificate Issued", + "Windows Steal Authentication Certificates Certificate Request", + "Windows Steal Authentication Certificates CryptoAPI", + "Windows Steal Authentication Certificates Export Certificate", + "Windows Steal Authentication Certificates Export PfxCertificate", + "Windows Steal or Forge Kerberos Tickets Klist", + "Windows SubInAcl Execution", + "Windows Suspect Process With Authentication Traffic", + "Windows Suspicious Burst of Password Changes", + "Windows Suspicious C2 Named Pipe", + "Windows Suspicious Child Process Spawned From WebServer", + "Windows Suspicious Child Process of TieringEngineService.exe", + "Windows Suspicious Defender Engine or Signature Files Created", + "Windows Suspicious Defender Update Activity in INetCache", + "Windows Suspicious Driver Loaded Path", + "Windows Suspicious File in EFI Volume", + "Windows Suspicious Named Pipe", + "Windows Suspicious Process File Path", + "Windows Suspicious QEMU Execution", + "Windows Suspicious React or Next.js Child Process", + "Windows Suspicious VMWare Tools Child Process", + "Windows Svchost.exe Parent Process Anomaly", + "Windows SymbolicLink-Testing-Tools Utility Execution", + "Windows Symlink Evaluation Change via Fsutil", + "Windows System Binary Proxy Execution Compiled HTML File Decompile", "Windows System Binary Proxy Execution MSIExec", + "Windows System Discovery Using Qwinsta", + "Windows System Discovery Using ldap Nslookup", + "Windows System File on Disk", + "Windows System LogOff Commandline", + "Windows System Network Config Discovery Display DNS", + "Windows System Network Connections Discovery Netsh", + "Windows System Reboot CommandLine", + "Windows System Remote Discovery With Query", + "Windows System Script Proxy Execution Syncappvpublishingserver", + "Windows System Shutdown CommandLine", + "Windows System Time Discovery W32tm Delay", + "Windows System User Discovery Via Quser", + "Windows System User Privilege Discovery", + "Windows TOR Client Execution", + "Windows TeamCity Payload Execution from Temp Directory", + "Windows TeamCity Plugin Installed", + "Windows Terminating Lsass Process", + "Windows Theme File Creation in Unusual Location", + "Windows Time Based Evasion", + "Windows Time Based Evasion via Choice Exec", + "Windows TinyCC Shellcode Execution", + "Windows UAC Bypass Suspicious Child Process", + "Windows UAC Bypass Suspicious Escalation Behavior", + "Windows USBSTOR Registry Key Modification", + "Windows Uncommon Remote Thread Creation In Browser Process", + "Windows Universal Data Link File Creation", + "Windows Unsecured Outlook Credentials Access In Registry", + "Windows Unsigned DLL Side-Loading", + "Windows Unsigned DLL Side-Loading In Same Process Path", + "Windows Unsigned MS DLL Side-Loading", + "Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos", + "Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos", + "Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM", + "Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials", + "Windows Unusual Count Of Users Failed To Auth Using Kerberos", + "Windows Unusual Count Of Users Failed To Authenticate From Process", + "Windows Unusual Count Of Users Failed To Authenticate Using NTLM", + "Windows Unusual Count Of Users Remotely Failed To Auth From Host", + "Windows Unusual File Creation in Confluence Directory", + "Windows Unusual FileZilla XML Config Access", + "Windows Unusual Intelliform Storage Registry Access", + "Windows Unusual NTLM Authentication Destinations By Source", + "Windows Unusual NTLM Authentication Destinations By User", + "Windows Unusual NTLM Authentication Users By Destination", + "Windows Unusual NTLM Authentication Users By Source", + "Windows Unusual Process Load Mozilla NSS-Mozglue Module", + "Windows Unusual SysWOW64 Process Run System32 Executable", "Windows Updates Install Failures", "Windows Updates Install Successes", + "Windows User Deletion Via Net", + "Windows User Disabled Via Net", + "Windows User Discovery Via Net", + "Windows User Execution Malicious URL Shortcut File", + "Windows VSSVC Process Accessing Defender Engine", + "Windows Visual Basic Commandline Compiler DNSQuery", + "Windows Vulnerable 3CX Software", + "Windows Vulnerable Driver Installed", + "Windows Vulnerable Driver Loaded", + "Windows WBAdmin File Recovery From Backup", + "Windows WMI Impersonate Token", + "Windows WMI Process And Service List", + "Windows WMI Process Call Create", + "Windows WMI Reconnaissance Class Query", + "Windows WMIC Shadowcopy Delete", + "Windows WPDBusEnum Registry Key Modification", + "Windows WSUS Spawning Shell", + "Windows Wermgr Alternate Data Stream in Temp Dir", + "Windows WinDBG Spawning AutoIt3", + "Windows WinLogon with Public Network Connection", + "Windows WinPEAS PowerShell Script Execution", + "Windows WinRAR Launched Outside Default Installation Directory", + "Windows WinSCP Configuration Security Access", + "Windows Wmic CPU Discovery", + "Windows Wmic DiskDrive Discovery", + "Windows Wmic Memory Chip Discovery", + "Windows Wmic Network Discovery", + "Windows Wmic Systeminfo Discovery", + "Windows XLL File Creation Outside of Typical Location", + "Winhlp32 Spawning a Process", "Winter Vivern", + "Wmic Group Discovery", + "Wmic NonInteractive App Uninstallation", + "Wmiprvse LOLBAS Execution Process Spawn", + "WordPress Bricks Builder plugin RCE", "WordPress Vulnerabilities", + "Wscript Or Cscript Suspicious Child Process", + "Wsmprovhost LOLBAS Execution Process Spawn", "XML Runner Loader", + "XMRIG Driver Loaded", "XMRig", + "XSL Script Execution With WMIC", "XWorm", "XorDDos", "ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day", "ZOVWiper", "Zeek Conn", + "Zeek x509 Certificate with Punycode", + "Zoom High Video Latency", + "Zoom Rare Audio Devices", + "Zoom Rare Input Devices", + "Zoom Rare Video Devices", + "Zscaler Adware Activities Threat Blocked", + "Zscaler Behavior Analysis Threat Blocked", "Zscaler Browser Proxy Threats", + "Zscaler CryptoMiner Downloaded Threat Blocked", + "Zscaler Employment Search Web Activity", + "Zscaler Exploit Threat Blocked", + "Zscaler Legal Liability Threat Blocked", + "Zscaler Malware Activity Threat Blocked", + "Zscaler Phishing Activity Threat Blocked", + "Zscaler Potentially Abused File Download", + "Zscaler Privacy Risk Destinations Threat Blocked", + "Zscaler Scam Destinations Threat Blocked", + "Zscaler Virus Download threat blocked", "ace_access_rights_lookup", "ace_flag_lookup", "ace_type_lookup", @@ -717,6 +2853,9 @@ "applockereventcodes", "asr_rules", "attacker_tools", + "audit_searches", + "audittrail", + "aws_bedrock_claude", "aws_cloudwatchlogs_eks", "aws_config", "aws_description", @@ -737,6 +2876,7 @@ "brand_abuse_dns", "brand_abuse_email", "brand_abuse_web", + "bro_ssl_json", "browser_app_list", "browser_process_and_path", "builtin_groups_lookup", @@ -748,6 +2888,7 @@ "cisco_asa", "cisco_duo_activity", "cisco_duo_administrator", + "cisco_ios", "cisco_isovalent", "cisco_isovalent_allowed_images", "cisco_isovalent_process_connect", @@ -756,6 +2897,8 @@ "cisco_networks", "cisco_sd_wan_service_proxy_access", "cisco_sd_wan_syslog", + "cisco_secure_access_dns", + "cisco_secure_access_proxy", "cisco_secure_firewall", "cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools", "cisco_secure_firewall_filetype_lookup", @@ -879,6 +3022,7 @@ "osquery_macro", "osquery_process", "papercutng", + "path_traversal_spl_injection", "pingid", "potential_password_in_username_false_positive_reduction", "potentially_malicious_code_on_cmdline_tokenize_score", @@ -992,12 +3136,24 @@ "s3_deletion_baseline", "sAMAccountName Spoofing and Domain Controller Impersonation", "scripting_tools_user_agents", + "secureapp_attack", "secureapp_es_field_mappings", "security_content_ctime", "security_content_summariesonly", "security_group_activity_baseline", "security_group_api_calls", "security_services_lookup", + "splunk_crash_log", + "splunk_python", + "splunk_risky_command", + "splunkd", + "splunkd_failed_auths", + "splunkd_investigation_rest_handler", + "splunkd_ui", + "splunkd_web", + "splunkd_webs", + "splunkd_webx", + "splunkda", "sslbl_ssl_certificate_blacklist", "stream_dns", "stream_http", @@ -1019,6 +3175,7 @@ "typo_squatted_python_packages", "uacbypass_process_name", "uncommon_processes", + "windchill_log4j", "windows_exchange_iis", "windows_protocol_handlers", "windows_shells", @@ -1113,6 +3270,7 @@ "d141afeb-d2bc-4934-8dd5-b7dba0f9f67a", "e9fdb899-a980-4ba4-934b-486ad22e22f4", "8164a4a6-f99c-4661-ac4f-80f5e4e78d2b", + "ec9ab81c-8053-4957-8c66-0218381ab564", "46959285-906d-40fa-9437-5a439accd878", "68190529-069b-4ffc-a942-919704158065", "ec23cef9-27d9-46e4-a68d-6f75f7b86908", @@ -1177,6 +3335,7 @@ "d9efa6c7-6518-42b2-809a-4f2a8e242b9b", "251c5936-569f-42f4-9ac2-87a173b9e9b8", "78bd3fa7-773c-449e-a978-dc1f1500bc52", + "cec8ad4e-0320-4984-a1ae-70ee398c9519", "15f44ea9-4571-4837-be9e-802431a7bfae", "bf23c7dc-1004-4949-8262-4c1d1ef87702", "952931a4-af0b-4335-bbbe-73c8c5b327ae", @@ -1284,6 +3443,7 @@ "ac494fe5-81a4-4897-af42-e774cf005ecb", "b8a49f03-e3c4-40f2-b7bb-9e8f8fdddbf1", "3b7015f2-3144-4205-b799-b05580621379", + "7dd05b3e-0803-4852-9345-c494eb3e40fe", "191db57d-091a-47d5-99f3-97fde53de505", "ccf4ac39-ec93-42be-9035-90e2f26bcd92", "93c150f5-ad7b-4ee3-8992-df06dec2ac79", @@ -1316,8 +3476,8 @@ "94f6a1c9-aae7-46a4-9083-2bb1f5768ec4", "bac8a340-be64-4491-a0cc-0985cb227f5a", "234f9b7c-b53d-4f32-897b-b880a6c9ea7b", - "b8147c9a-84db-4ec1-8eee-4e0da75f0de5", "b877943f-0377-44f4-8477-f79db7f07c4d", + "b8147c9a-84db-4ec1-8eee-4e0da75f0de5", "54782d65-12f0-47a5-b4c1-b70ee23de6df", "e03ada14-0980-4107-aff1-7783b2b59bb1", "e7e3a525-7612-4d68-a5d3-c4649181b8af", @@ -1552,7 +3712,9 @@ "6326dbc4-444b-4c04-88f4-27e94d0327cb", "9ebe7901-7edf-45c0-b5c7-8366300919db", "8fe2ccfd-f079-4c03-b1a9-bd9b362b67d4", + "5fabf878-7dd4-48d3-9995-408fac68e166", "069258f4-2162-46e9-9a25-c9c6c56150d2", + "4383bbd3-aa6c-49fd-a1a9-cf112c95982c", "815bef8b-bf91-4b67-be4c-abe4c2a94ccc", "42510244-5019-48fa-a0e5-66c3b76e6049", "9d04efee-eff5-4240-b8d2-07792b873608", @@ -1662,6 +3824,7 @@ "bc15c13f-d121-4b1f-8c7d-28d95854d086", "281201e7-de41-4dc9-b73d-f288938cbb64", "eb121494-82d1-4148-9e2b-e624e03fbf3d", + "f0057c81-24dc-4a2e-b658-5809c242180b", "653d39cd-bae7-499a-898c-9fb96b8b5cd1", "7a48f482-246f-4aeb-9837-21c271ebf244", "486e88ea-4f56-470f-9b57-3f4d73f39133", @@ -1680,6 +3843,7 @@ "41274289-ec9c-4213-bea4-e43c4aa57954", "4963a81e-a3ad-4f02-adda-812343b351de", "d3415a0e-66ef-429b-acf4-a768876954f6", + "35ad6590-2207-4b14-bf8f-9899470d7156", "e2d85e66-cb66-4ed7-93b1-833fc56c9319", "86a43bad-12e3-4e85-b97c-4d5cf25b95c3", "49543237-25db-497b-90df-d0a0a6e8fe2c", @@ -1832,6 +3996,7 @@ "640cbf6d-659b-498b-ba53-f6dd1a1cc02c", "c3ed6d2a-e3ad-400d-ad78-bbfdbfeacc08", "abcde488-e083-4ee7-bc85-a5684edd7541", + "c666acd6-6ff5-4d28-9490-195d89cd4337", "d380c318-0b34-45cb-9dad-828c11891e43", "9e8894c0-50bd-4525-a96c-d4ac78ece388", "913c0e4e-4b37-4b78-ad0b-90e7b25010f6", @@ -2149,6 +4314,7 @@ "4c8db261-a58b-42a6-a866-0a294deedde4", "f0027655-25ef-47b0-acaf-3d83d106156c", "c75612b2-9de0-4d7c-879c-10d7b077072d", + "5696f417-30e5-4942-988d-0b9dcfe3a929", "d322cdd7-7d60-46e3-9111-648848da7c02", "a8568b10-9ab9-4140-a523-1c72e0176924", "33ca84bc-4259-4943-bd36-4655dc420932", @@ -2263,6 +4429,7 @@ "ae4b6361-b5f8-46cb-a3f9-9cf108ccfe7b", "394a538e-09bb-4a4a-95d1-b93cf12682a8", "1a02df58-09af-4064-a765-0babe1a0d1e2", + "40c44d16-bb49-4d14-aafa-f9ba7e6e6c5b", "4238a7f0-a980-4fff-98a2-dfc0a363d507", "00c652e2-0750-4ca6-82ff-0204684a6fe4", "58ed10e8-0738-4651-8408-3a3e9a526279", @@ -2295,6 +4462,7 @@ "5bec4cc8-f41e-437b-b417-33ff60acf9af", "a0c1725f-abcd-40d6-baac-020f3cf94ecd", "d1c73b96-ab87-4031-bad8-0e1b3b8bf3ec", + "3d9e332e-60c9-407a-af4c-a9ae43c4f1d0", "7c8c7bd8-0a5c-4514-a6a3-0814c5a98cf0", "a83ad6e8-6f24-4d7f-8f44-75f8ab742991", "7e7ac3ed-f795-4fa5-b711-09d6fbe9b873", @@ -2378,6 +4546,7 @@ "0315bdff-4178-47e9-81e4-f31a6d23f7e4", "736b4f53-f400-4c22-855d-1a6b5a551600", "114dd4e3-8d1c-4ea7-bb8d-8d8f6aca21f0", + "3f452c87-25b5-47c0-81d8-01908df1b927", "183235ca-8e6c-422c-88c2-3aa28c4825d9", "b4ca838d-d013-4461-bf2c-f7132617b409", "0b79c06f-c788-44a2-8630-d69051f1123d", @@ -2831,6 +5000,7 @@ "453acf13-1dbd-47d7-b28a-172ce9228023", "da4f751a-020b-40d7-b9ff-d433b7799803", "14033063-ee04-4eaf-8f5d-ba07ca7a097c", + "14bd90b1-c3f3-4115-9861-cf0519a59654", "8bec51da-7a6d-4346-b941-51eca448c4b0", "1d958c61-09c6-4d9e-b26b-4130314e520e", "12e03af7-79f9-4f95-af48-d3f12f28a260", @@ -2880,8 +5050,9 @@ "96db2632-8417-4dbb-b8bb-a8b92ba391de", "a50d5a97-2531-499e-a1de-5544c74432c6", "6cd715aa-20ac-4be1-a8f1-dda7bae160bd", - "44a4bedf-ffe3-452e-bee4-6925ab125662", + "50859b3b-b088-4c7b-973d-03a0365a9bf9", "16f6374f-7600-459a-9b16-6a88fd96d310", + "44a4bedf-ffe3-452e-bee4-6925ab125662", "e9584f82-322c-474a-b831-940fd8b4455c", "e6f36545-dc1e-47f0-9f48-7f730f54a02e", "52778a8f-a10b-41a4-9eae-52ddb74072bf", @@ -3309,6 +5480,7 @@ "BlackMatter Ransomware", "BlackSuit Ransomware", "BlankGrabber Stealer", + "BlueHammer", "Brand Monitoring", "Braodo Stealer", "Browser Hijacking", @@ -3479,10 +5651,12 @@ "Orangeworm Attack Group", "Outlook RCE CVE-2024-21378", "PHP-CGI RCE Attack on Japanese Organizations", + "PTC Windchill Exploitation", "PXA Stealer", "PaperCut MF NG Vulnerability", "PathWiper", "PetitPotam NTLM Relay on Active Directory Certificate Services", + "Phantom Stealer", "Phemedrone Stealer", "PlugX", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", @@ -3500,17 +5674,20 @@ "Ransomware Cloud", "React2Shell", "RedLine Stealer", + "RedSun", "Remcos", "Remote Employment Fraud", "Remote Monitoring and Management Software", "Reverse Network Proxy", "Revil Ransomware", "Rhysida Ransomware", + "RoguePlanet", "Router and Infrastructure Security", "Ryuk Ransomware", "SAP NetWeaver Exploitation", "SQL Injection", "SQL Server Abuse", + "Salat Stealer", "Salt Typhoon", "SamSam Ransomware", "Sandworm Tools", @@ -3530,11 +5707,13 @@ "Sneaky Active Directory Persistence Tricks", "SolarWinds WHD RCE Post Exploitation", "Spearphishing Attachments", + "Splunk Vulnerabilities", "Spring4Shell CVE-2022-22965", "StealC Stealer", "Storm-0501 Ransomware", "Storm-2460 CLFS Zero Day Exploitation", "Subvert Trust Controls SIP and Trust Provider Hijacking", + "Suspicious AWS Bedrock Claude Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", diff --git a/schemas/Playbook.schema.json b/schemas/Playbook.schema.json index aa4da253b5..e137faf11e 100644 --- a/schemas/Playbook.schema.json +++ b/schemas/Playbook.schema.json @@ -284,6 +284,13 @@ "ASL AWS SAML Update identity provider", "ASL AWS UpdateLoginProfile", "AWS AMI Attribute Modification for Exfiltration", + "AWS Bedrock Claude Cross Region Possible Inference Abuse", + "AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation", + "AWS Bedrock Claude Hostile Prompt Sentiment", + "AWS Bedrock Claude Possible Prompt Injection", + "AWS Bedrock Claude Sensitive Data in Prompts", + "AWS Bedrock Claude Unusually Large Prompts", + "AWS Bedrock Claude excessive use of tokens", "AWS Bedrock Delete GuardRails", "AWS Bedrock Delete Knowledge Base", "AWS Bedrock Delete Model Invocation Logging Configuration", @@ -360,7 +367,6 @@ "Amazon EKS Kubernetes cluster scan detection", "Anomalous usage of 7zip", "Attacker Tools On Endpoint", - "Attempt To Add Certificate To Untrusted Store", "Auto Admin Logon Registry Entry", "Azure AD Admin Consent Bypassed by Service Principal", "Azure AD Application Administrator Role Assigned", @@ -417,7 +423,6 @@ "BITSAdmin Download File", "Batch File Write to System32", "Bcdedit Command Back To Normal Mode Boot", - "CHCP Command Execution", "CMD Carry Out String Command Parameter", "CMD Echo Pipe - Escalation", "CMLUA Or CMSTPLUA UAC Bypass", @@ -459,7 +464,16 @@ "Cisco Duo Policy Skip 2FA for Other Countries", "Cisco Duo Set User Status to Bypass 2FA", "Cisco IOS Suspicious Privileged Account Creation", + "Cisco IOS XE Guestshell Activation and Destroy", "Cisco IOS XE Implant Access", + "Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal", + "Cisco IOS XE Reconnaissance Command Activity", + "Cisco IOS XE Remote Access Probe Burst", + "Cisco IOS XE Request Platform Package Describe Shell Pattern", + "Cisco IOS XE Tunnel Interface Configuration", + "Cisco IOS XE VTY Access Class Tampering", + "Cisco IOS XE WebUI Login From IOSd Local Port", + "Cisco IOS XE WebUI Programmatic Configuration", "Cisco Isovalent - Access To Cloud Metadata Service", "Cisco Isovalent - Cron Job Creation", "Cisco Isovalent - Curl Execution With Insecure Flags", @@ -487,10 +501,14 @@ "Cisco Network Interface Modifications", "Cisco Privileged Account Creation with HTTP Command Execution", "Cisco Privileged Account Creation with Suspicious SSH Activity", + "Cisco SA - Access to Anonymizer Services", + "Cisco SA - Automated Web Reconnaissance via HTTP Access Errors", "Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity", "Cisco SD-WAN - Low Frequency Rogue Peer", "Cisco SD-WAN - Peering Activity", "Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity", + "Cisco SD-WAN Multiple SSH key Authentication from Same Source", + "Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication", "Cisco SNMP Community String Configuration Changes", "Cisco Secure Firewall - Binary File Type Download", "Cisco Secure Firewall - Bits Network Activity", @@ -897,7 +915,6 @@ "Ivanti EPM SQL Injection Remote Code Execution", "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078", "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082", - "Ivanti Sentry Authentication Bypass", "Ivanti VTM New Account Creation", "Java Class File download by Java User Agent", "Java Writing JSP File", @@ -1013,6 +1030,7 @@ "Linux Auditd Unload Module Via Modprobe", "Linux Auditd Virtual Disk File And Directory Discovery", "Linux Auditd Whoami User Discovery", + "Linux Binary Launched Process with Null Argv", "Linux Busybox Privilege Escalation", "Linux Change File Owner To Root", "Linux Clipboard Data Copy", @@ -1029,6 +1047,7 @@ "Linux Deletion Of Init Daemon Script", "Linux Deletion Of Services", "Linux Deletion of SSL Certificate", + "Linux Dirty Frag Kernel Privilege Escalation", "Linux Disable Services", "Linux Doas Conf File Creation", "Linux Doas Tool Execution", @@ -1059,6 +1078,7 @@ "Linux Kworker Process In Writable Process Path", "Linux Magic SysRq Key Abuse", "Linux Make Privilege Escalation", + "Linux Malformed Auth Entry", "Linux Medusa Rootkit", "Linux MySQL Privilege Escalation", "Linux NOPASSWD Entry In Sudoers File", @@ -1067,6 +1087,7 @@ "Linux Obfuscated Files or Information Base64 Decode", "Linux Octave Privilege Escalation", "Linux OpenVPN Privilege Escalation", + "Linux PF_ALG Registration Outside of Boot Window", "Linux PHP Privilege Escalation", "Linux Persistence and Privilege Escalation Risk Behavior", "Linux Possible Access Or Modification Of sshd Config File", @@ -1095,6 +1116,7 @@ "Linux Stop Services", "Linux Sudo OR Su Execution", "Linux Sudoers Tmp File Creation", + "Linux Suspicious Namespace Creation", "Linux Suspicious React or Next.js Child Process", "Linux System Network Discovery", "Linux System Reboot Via System Request Key", @@ -1295,6 +1317,8 @@ "Ollama Suspicious Prompt Injection Jailbreak", "Outbound Network Connection from Java Using Default Ports", "Overwriting Accessibility Binaries", + "PTC Windchill GW READY OK Probe", + "PTC Windchill Gateway Command Execution", "PaperCut NG Remote Web Access Attempt", "PaperCut NG Suspicious Behavior Debug Log", "Permission Modification using Takeown App", @@ -1327,6 +1351,7 @@ "PowerShell WebRequest Using Memory Stream", "Powershell COM Hijacking InprocServer32 Modification", "Powershell Creating Thread Mutex", + "Powershell Defender Threat Actions Set to Allow", "Powershell Disable Security Monitoring", "Powershell Enable SMB1Protocol Feature", "Powershell Execute COM Object", @@ -1350,7 +1375,6 @@ "Process Kill Base On File Path", "Process Writing DynamicWrapperX", "Processes Tapping Keyboard Events", - "Processes launching netsh", "Prohibited Network Traffic Allowed", "Protocol or Port Mismatch", "Protocols passing authentication in cleartext", @@ -1410,7 +1434,6 @@ "SQL Injection with Long URLs", "SSL Certificates with Punycode", "Samsam Test File Write", - "Sc exe Manipulating Windows Services", "SchCache Change By App Connect And Create ADSI Object", "Schedule Task with HTTP Command Arguments", "Schedule Task with Rundll32 Command Trigger", @@ -1440,7 +1463,20 @@ "SilentCleanup UAC Bypass", "Single Letter Process On Endpoint", "Spike in File Writes", + "Splunk App for Lookup File Editing RCE via User XSLT", "Splunk AppDynamics Secure Application Alerts", + "Splunk Authentication Token Exposure in Debug Log", + "Splunk Code Injection via custom dashboard leading to RCE", + "Splunk Enterprise KV Store Incorrect Authorization", + "Splunk Information Disclosure on Account Login", + "Splunk Path Traversal In Splunk App For Lookup File Edit", + "Splunk RCE PDFgen Render", + "Splunk RCE Through Arbitrary File Write to Windows System Root", + "Splunk RCE via User XSLT", + "Splunk Secure Application Alerts for Runtime Security", + "Splunk Sensitive Information Disclosure in DEBUG Logging Channels", + "Splunk User Enumeration Attempt", + "Splunk XSS Privilege Escalation via Custom Urls in Dashboard", "Spoolsv Spawning Rundll32", "Spoolsv Suspicious Loaded Modules", "Spoolsv Suspicious Process Access", @@ -1586,6 +1622,7 @@ "Windows Account Discovery for None Disable User Account", "Windows Account Discovery for Sam Account Name", "Windows AdFind Exe", + "Windows Admin Password Changed by Non-Admin", "Windows Admin Permission Discovery", "Windows Administrative Shares Accessed On Multiple Hosts", "Windows Admon Default Group Policy Object Modified", @@ -1657,6 +1694,8 @@ "Windows Cisco Secure Endpoint Unblock File Via Sfc", "Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc", "Windows ClipBoard Data via Get-ClipBoard", + "Windows Cloud Files Filter Loaded by Uncommon Process", + "Windows Cloud Files Filter Log Created by Non-System Process", "Windows Cmdline Tool Execution From Non-Shell Process", "Windows Cobalt Strike PowerShell Loader", "Windows Command Obfuscation with Environment Variable Substrings", @@ -1776,6 +1815,8 @@ "Windows Explorer LNK Exploit Process Launch With Padding", "Windows Explorer.exe Spawning PowerShell or Cmd", "Windows Export Certificate", + "Windows FFmpeg Audio and Video Device Discovery", + "Windows FFmpeg DirectShow Video Capture", "Windows File Association Modification via Ftype", "Windows File Collection Via Copy Utilities", "Windows File Download Via CertUtil", @@ -1954,6 +1995,7 @@ "Windows Modify Show Compress Color And Info Tip Registry", "Windows Modify System Firewall with Notable Process Path", "Windows MpCmdRun RemoveDefinitions Execution", + "Windows MsMpEng Writing to System32", "Windows Mshta Execution In Registry", "Windows MsiExec HideWindow Rundll32 Execution", "Windows Multi hop Proxy TOR Website Query", @@ -1989,6 +2031,7 @@ "Windows Njrat Fileless Storage via Registry", "Windows Non Discord App Access Discord LevelDB", "Windows Non-System Account Targeting Lsass", + "Windows Non-System Process Querying Definition Update", "Windows NorthStar C2 Agent Execution", "Windows Obfuscated Files or Information via RAR SFX", "Windows Odbcconf Hunting", @@ -2216,8 +2259,12 @@ "Windows Steal or Forge Kerberos Tickets Klist", "Windows SubInAcl Execution", "Windows Suspect Process With Authentication Traffic", + "Windows Suspicious Burst of Password Changes", "Windows Suspicious C2 Named Pipe", "Windows Suspicious Child Process Spawned From WebServer", + "Windows Suspicious Child Process of TieringEngineService.exe", + "Windows Suspicious Defender Engine or Signature Files Created", + "Windows Suspicious Defender Update Activity in INetCache", "Windows Suspicious Driver Loaded Path", "Windows Suspicious File in EFI Volume", "Windows Suspicious Named Pipe", @@ -2253,6 +2300,7 @@ "Windows UAC Bypass Suspicious Child Process", "Windows UAC Bypass Suspicious Escalation Behavior", "Windows USBSTOR Registry Key Modification", + "Windows Uncommon Remote Thread Creation In Browser Process", "Windows Universal Data Link File Creation", "Windows Unsecured Outlook Credentials Access In Registry", "Windows Unsigned DLL Side-Loading", @@ -2279,6 +2327,7 @@ "Windows User Disabled Via Net", "Windows User Discovery Via Net", "Windows User Execution Malicious URL Shortcut File", + "Windows VSSVC Process Accessing Defender Engine", "Windows Visual Basic Commandline Compiler DNSQuery", "Windows Vulnerable 3CX Software", "Windows Vulnerable Driver Installed", @@ -2291,10 +2340,12 @@ "Windows WMIC Shadowcopy Delete", "Windows WPDBusEnum Registry Key Modification", "Windows WSUS Spawning Shell", + "Windows Wermgr Alternate Data Stream in Temp Dir", "Windows WinDBG Spawning AutoIt3", "Windows WinLogon with Public Network Connection", "Windows WinPEAS PowerShell Script Execution", "Windows WinRAR Launched Outside Default Installation Directory", + "Windows WinSCP Configuration Security Access", "Windows Wmic CPU Discovery", "Windows Wmic DiskDrive Discovery", "Windows Wmic Memory Chip Discovery", @@ -2430,6 +2481,7 @@ "BlackMatter Ransomware", "BlackSuit Ransomware", "BlankGrabber Stealer", + "BlueHammer", "Brand Monitoring", "Braodo Stealer", "Browser Hijacking", @@ -2600,10 +2652,12 @@ "Orangeworm Attack Group", "Outlook RCE CVE-2024-21378", "PHP-CGI RCE Attack on Japanese Organizations", + "PTC Windchill Exploitation", "PXA Stealer", "PaperCut MF NG Vulnerability", "PathWiper", "PetitPotam NTLM Relay on Active Directory Certificate Services", + "Phantom Stealer", "Phemedrone Stealer", "PlugX", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", @@ -2621,17 +2675,20 @@ "Ransomware Cloud", "React2Shell", "RedLine Stealer", + "RedSun", "Remcos", "Remote Employment Fraud", "Remote Monitoring and Management Software", "Reverse Network Proxy", "Revil Ransomware", "Rhysida Ransomware", + "RoguePlanet", "Router and Infrastructure Security", "Ryuk Ransomware", "SAP NetWeaver Exploitation", "SQL Injection", "SQL Server Abuse", + "Salat Stealer", "Salt Typhoon", "SamSam Ransomware", "Sandworm Tools", @@ -2651,11 +2708,13 @@ "Sneaky Active Directory Persistence Tricks", "SolarWinds WHD RCE Post Exploitation", "Spearphishing Attachments", + "Splunk Vulnerabilities", "Spring4Shell CVE-2022-22965", "StealC Stealer", "Storm-0501 Ransomware", "Storm-2460 CLFS Zero Day Exploitation", "Subvert Trust Controls SIP and Trust Provider Hijacking", + "Suspicious AWS Bedrock Claude Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", diff --git a/schemas/RemovedContent.schema.json b/schemas/RemovedContent.schema.json index da74df0347..43e4b536ea 100644 --- a/schemas/RemovedContent.schema.json +++ b/schemas/RemovedContent.schema.json @@ -43,6 +43,14 @@ "ASL AWS SAML Update identity provider", "ASL AWS UpdateLoginProfile", "AWS AMI Attribute Modification for Exfiltration", + "AWS Bedrock Claude", + "AWS Bedrock Claude Cross Region Possible Inference Abuse", + "AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation", + "AWS Bedrock Claude Hostile Prompt Sentiment", + "AWS Bedrock Claude Possible Prompt Injection", + "AWS Bedrock Claude Sensitive Data in Prompts", + "AWS Bedrock Claude Unusually Large Prompts", + "AWS Bedrock Claude excessive use of tokens", "AWS Bedrock Delete GuardRails", "AWS Bedrock Delete Knowledge Base", "AWS Bedrock Delete Model Invocation Logging Configuration", @@ -212,7 +220,6 @@ "AsyncRAT", "Atlassian Confluence Server and Data Center CVE-2022-26134", "Attacker Tools On Endpoint", - "Attempt To Add Certificate To Untrusted Store", "Attribute Lookup Dispatch", "Auto Admin Logon Registry Entry", "Automated Enrichment", @@ -323,6 +330,7 @@ "BlackSuit Ransomware", "BlankGrabber Stealer", "Block Indicators", + "BlueHammer", "Brand Monitoring", "Braodo Stealer", "Bro conn", @@ -337,7 +345,6 @@ "Bro x509", "Browser Hijacking", "Brute Ratel C4", - "CHCP Command Execution", "CISA AA22-257A", "CISA AA22-264A", "CISA AA22-277A", @@ -403,8 +410,17 @@ "Cisco Duo Suspicious Activity", "Cisco IOS Logs", "Cisco IOS Suspicious Privileged Account Creation", + "Cisco IOS XE Guestshell Activation and Destroy", "Cisco IOS XE Implant Access", + "Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal", + "Cisco IOS XE Reconnaissance Command Activity", + "Cisco IOS XE Remote Access Probe Burst", + "Cisco IOS XE Request Platform Package Describe Shell Pattern", "Cisco IOS XE Software Web Management User Interface vulnerability", + "Cisco IOS XE Tunnel Interface Configuration", + "Cisco IOS XE VTY Access Class Tampering", + "Cisco IOS XE WebUI Login From IOSd Local Port", + "Cisco IOS XE WebUI Programmatic Configuration", "Cisco Isovalent - Access To Cloud Metadata Service", "Cisco Isovalent - Cron Job Creation", "Cisco Isovalent - Curl Execution With Insecure Flags", @@ -439,15 +455,22 @@ "Cisco Network Visibility Module OSquery", "Cisco Privileged Account Creation with HTTP Command Execution", "Cisco Privileged Account Creation with Suspicious SSH Activity", + "Cisco SA - Access to Anonymizer Services", + "Cisco SA - Automated Web Reconnaissance via HTTP Access Errors", "Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity", "Cisco SD-WAN - Low Frequency Rogue Peer", "Cisco SD-WAN - Peering Activity", "Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity", + "Cisco SD-WAN Auth Log", + "Cisco SD-WAN Multiple SSH key Authentication from Same Source", + "Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication", "Cisco SD-WAN NTCE 1000001", "Cisco SD-WAN Service Proxy Access Logs", "Cisco SNMP Community String Configuration Changes", "Cisco Secure Access Analytics", + "Cisco Secure Access DNS", "Cisco Secure Access Firewall", + "Cisco Secure Access Proxy", "Cisco Secure Firewall - Binary File Type Download", "Cisco Secure Firewall - Bits Network Activity", "Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint", @@ -989,7 +1012,6 @@ "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078", "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082", "Ivanti EPMM Remote Unauthenticated Access", - "Ivanti Sentry Authentication Bypass", "Ivanti Sentry Authentication Bypass CVE-2023-38035", "Ivanti VTM Audit", "Ivanti VTM New Account Creation", @@ -1131,6 +1153,7 @@ "Linux Auditd Unload Module Via Modprobe", "Linux Auditd Virtual Disk File And Directory Discovery", "Linux Auditd Whoami User Discovery", + "Linux Binary Launched Process with Null Argv", "Linux Busybox Privilege Escalation", "Linux Change File Owner To Root", "Linux Clipboard Data Copy", @@ -1147,6 +1170,7 @@ "Linux Deletion Of Init Daemon Script", "Linux Deletion Of Services", "Linux Deletion of SSL Certificate", + "Linux Dirty Frag Kernel Privilege Escalation", "Linux Disable Services", "Linux Doas Conf File Creation", "Linux Doas Tool Execution", @@ -1178,7 +1202,9 @@ "Linux Living Off The Land", "Linux Magic SysRq Key Abuse", "Linux Make Privilege Escalation", + "Linux Malformed Auth Entry", "Linux Medusa Rootkit", + "Linux Messages Syslog", "Linux MySQL Privilege Escalation", "Linux NOPASSWD Entry In Sudoers File", "Linux Ngrok Reverse Proxy Usage", @@ -1186,6 +1212,7 @@ "Linux Obfuscated Files or Information Base64 Decode", "Linux Octave Privilege Escalation", "Linux OpenVPN Privilege Escalation", + "Linux PF_ALG Registration Outside of Boot Window", "Linux PHP Privilege Escalation", "Linux Persistence Techniques", "Linux Persistence and Privilege Escalation Risk Behavior", @@ -1219,6 +1246,7 @@ "Linux Stop Services", "Linux Sudo OR Su Execution", "Linux Sudoers Tmp File Creation", + "Linux Suspicious Namespace Creation", "Linux Suspicious React or Next.js Child Process", "Linux System Network Discovery", "Linux System Reboot Via System Request Key", @@ -1507,6 +1535,9 @@ "Outlook RCE CVE-2024-21378", "Overwriting Accessibility Binaries", "PHP-CGI RCE Attack on Japanese Organizations", + "PTC Windchill Exploitation", + "PTC Windchill GW READY OK Probe", + "PTC Windchill Gateway Command Execution", "PXA Stealer", "Palo Alto Network Threat", "Palo Alto Network Traffic", @@ -1519,6 +1550,7 @@ "PetitPotam NTLM Relay on Active Directory Certificate Services", "PetitPotam Network Share Access Request", "PetitPotam Suspicious Kerberos TGT Request", + "Phantom Stealer", "Phemedrone Stealer", "PhishTank URL Reputation Analysis", "Ping Sleep Batch Command", @@ -1551,6 +1583,7 @@ "PowerShell WebRequest Using Memory Stream", "Powershell COM Hijacking InprocServer32 Modification", "Powershell Creating Thread Mutex", + "Powershell Defender Threat Actions Set to Allow", "Powershell Disable Security Monitoring", "Powershell Enable SMB1Protocol Feature", "Powershell Execute COM Object", @@ -1601,7 +1634,6 @@ "Process Kill Base On File Path", "Process Writing DynamicWrapperX", "Processes Tapping Keyboard Events", - "Processes launching netsh", "Prohibited Network Traffic Allowed", "Prohibited Traffic Allowed or Protocol Mismatch", "PromptFlux", @@ -1626,6 +1658,7 @@ "Recon Using WMI Class", "Recursive Delete of Directory In Batch CMD", "RedLine Stealer", + "RedSun", "Reg exe Manipulating Windows Services Registry Keys", "Registry Keys Used For Persistence", "Registry Keys Used For Privilege Escalation", @@ -1669,6 +1702,7 @@ "Risk Notable Review Indicators", "Risk Notable Verdict", "Risk Rule for Dev Sec Ops by Repository", + "RoguePlanet", "Router and Infrastructure Security", "Rubeus Command Line Parameters", "Rubeus Kerberos Ticket Exports Through Winlogon Access", @@ -1696,11 +1730,11 @@ "SQL Injection with Long URLs", "SQL Server Abuse", "SSL Certificates with Punycode", + "Salat Stealer", "Salt Typhoon", "SamSam Ransomware", "Samsam Test File Write", "Sandworm Tools", - "Sc exe Manipulating Windows Services", "Scattered Lapsus$ Hunters", "Scattered Spider", "SchCache Change By App Connect And Create ADSI Object", @@ -1748,17 +1782,31 @@ "Spearphishing Attachments", "Spike in File Writes", "Splunk", + "Splunk App for Lookup File Editing RCE via User XSLT", "Splunk AppDynamics Secure Application Alert", "Splunk AppDynamics Secure Application Alerts", "Splunk Attack Analyzer Dynamic Analysis", + "Splunk Authentication Token Exposure in Debug Log", "Splunk Automated Email Investigation", + "Splunk Code Injection via custom dashboard leading to RCE", "Splunk Common Information Model (CIM)", + "Splunk Enterprise KV Store Incorrect Authorization", "Splunk Identifier Activity Analysis", + "Splunk Information Disclosure on Account Login", "Splunk Message Identifier Activity Analysis", "Splunk Notable Related Tickets Search", + "Splunk Path Traversal In Splunk App For Lookup File Edit", + "Splunk RCE PDFgen Render", + "Splunk RCE Through Arbitrary File Write to Windows System Root", + "Splunk RCE via User XSLT", + "Splunk Secure Application Alerts for Runtime Security", + "Splunk Sensitive Information Disclosure in DEBUG Logging Channels", "Splunk Stream HTTP", "Splunk Stream IP", "Splunk Stream TCP", + "Splunk User Enumeration Attempt", + "Splunk Vulnerabilities", + "Splunk XSS Privilege Escalation via Custom Urls in Dashboard", "Spoolsv Spawning Rundll32", "Spoolsv Suspicious Loaded Modules", "Spoolsv Suspicious Process Access", @@ -1776,6 +1824,7 @@ "Sunburst Correlation DLL and Network Event", "Supernova Webshell", "Suricata", + "Suspicious AWS Bedrock Claude Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", @@ -1949,6 +1998,7 @@ "WinRAR Spawning Shell Application", "WinRAR Spoofing Attack CVE-2023-38831", "WinRM Spawning a Process", + "Windchill Log4j", "Windows .Key File Creation in Root Directory", "Windows AD Abnormal Object Access Activity", "Windows AD AdminSDHolder ACL Modified", @@ -1996,6 +2046,7 @@ "Windows Account Discovery for Sam Account Name", "Windows Active Directory Admon", "Windows AdFind Exe", + "Windows Admin Password Changed by Non-Admin", "Windows Admin Permission Discovery", "Windows Administrative Shares Accessed On Multiple Hosts", "Windows Admon Default Group Policy Object Modified", @@ -2072,6 +2123,8 @@ "Windows Cisco Secure Endpoint Unblock File Via Sfc", "Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc", "Windows ClipBoard Data via Get-ClipBoard", + "Windows Cloud Files Filter Loaded by Uncommon Process", + "Windows Cloud Files Filter Log Created by Non-System Process", "Windows Cmdline Tool Execution From Non-Shell Process", "Windows Cobalt Strike PowerShell Loader", "Windows Command Obfuscation with Environment Variable Substrings", @@ -2224,6 +2277,7 @@ "Windows Event Log Security 4703", "Windows Event Log Security 4719", "Windows Event Log Security 4720", + "Windows Event Log Security 4723", "Windows Event Log Security 4724", "Windows Event Log Security 4725", "Windows Event Log Security 4726", @@ -2289,6 +2343,8 @@ "Windows Explorer LNK Exploit Process Launch With Padding", "Windows Explorer.exe Spawning PowerShell or Cmd", "Windows Export Certificate", + "Windows FFmpeg Audio and Video Device Discovery", + "Windows FFmpeg DirectShow Video Capture", "Windows File Association Modification via Ftype", "Windows File Collection Via Copy Utilities", "Windows File Download Via CertUtil", @@ -2471,6 +2527,7 @@ "Windows Modify Show Compress Color And Info Tip Registry", "Windows Modify System Firewall with Notable Process Path", "Windows MpCmdRun RemoveDefinitions Execution", + "Windows MsMpEng Writing to System32", "Windows Mshta Execution In Registry", "Windows MsiExec HideWindow Rundll32 Execution", "Windows Multi hop Proxy TOR Website Query", @@ -2506,6 +2563,7 @@ "Windows Njrat Fileless Storage via Registry", "Windows Non Discord App Access Discord LevelDB", "Windows Non-System Account Targeting Lsass", + "Windows Non-System Process Querying Definition Update", "Windows NorthStar C2 Agent Execution", "Windows Obfuscated Files or Information via RAR SFX", "Windows Odbcconf Hunting", @@ -2739,8 +2797,12 @@ "Windows Steal or Forge Kerberos Tickets Klist", "Windows SubInAcl Execution", "Windows Suspect Process With Authentication Traffic", + "Windows Suspicious Burst of Password Changes", "Windows Suspicious C2 Named Pipe", "Windows Suspicious Child Process Spawned From WebServer", + "Windows Suspicious Child Process of TieringEngineService.exe", + "Windows Suspicious Defender Engine or Signature Files Created", + "Windows Suspicious Defender Update Activity in INetCache", "Windows Suspicious Driver Loaded Path", "Windows Suspicious File in EFI Volume", "Windows Suspicious Named Pipe", @@ -2777,6 +2839,7 @@ "Windows UAC Bypass Suspicious Child Process", "Windows UAC Bypass Suspicious Escalation Behavior", "Windows USBSTOR Registry Key Modification", + "Windows Uncommon Remote Thread Creation In Browser Process", "Windows Universal Data Link File Creation", "Windows Unsecured Outlook Credentials Access In Registry", "Windows Unsigned DLL Side-Loading", @@ -2805,6 +2868,7 @@ "Windows User Disabled Via Net", "Windows User Discovery Via Net", "Windows User Execution Malicious URL Shortcut File", + "Windows VSSVC Process Accessing Defender Engine", "Windows Visual Basic Commandline Compiler DNSQuery", "Windows Vulnerable 3CX Software", "Windows Vulnerable Driver Installed", @@ -2817,10 +2881,12 @@ "Windows WMIC Shadowcopy Delete", "Windows WPDBusEnum Registry Key Modification", "Windows WSUS Spawning Shell", + "Windows Wermgr Alternate Data Stream in Temp Dir", "Windows WinDBG Spawning AutoIt3", "Windows WinLogon with Public Network Connection", "Windows WinPEAS PowerShell Script Execution", "Windows WinRAR Launched Outside Default Installation Directory", + "Windows WinSCP Configuration Security Access", "Windows Wmic CPU Discovery", "Windows Wmic DiskDrive Discovery", "Windows Wmic Memory Chip Discovery", @@ -2876,6 +2942,9 @@ "applockereventcodes", "asr_rules", "attacker_tools", + "audit_searches", + "audittrail", + "aws_bedrock_claude", "aws_cloudwatchlogs_eks", "aws_config", "aws_description", @@ -2896,6 +2965,7 @@ "brand_abuse_dns", "brand_abuse_email", "brand_abuse_web", + "bro_ssl_json", "browser_app_list", "browser_process_and_path", "builtin_groups_lookup", @@ -2907,6 +2977,7 @@ "cisco_asa", "cisco_duo_activity", "cisco_duo_administrator", + "cisco_ios", "cisco_isovalent", "cisco_isovalent_allowed_images", "cisco_isovalent_process_connect", @@ -2915,6 +2986,8 @@ "cisco_networks", "cisco_sd_wan_service_proxy_access", "cisco_sd_wan_syslog", + "cisco_secure_access_dns", + "cisco_secure_access_proxy", "cisco_secure_firewall", "cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools", "cisco_secure_firewall_filetype_lookup", @@ -3038,6 +3111,7 @@ "osquery_macro", "osquery_process", "papercutng", + "path_traversal_spl_injection", "pingid", "potential_password_in_username_false_positive_reduction", "potentially_malicious_code_on_cmdline_tokenize_score", @@ -3151,12 +3225,24 @@ "s3_deletion_baseline", "sAMAccountName Spoofing and Domain Controller Impersonation", "scripting_tools_user_agents", + "secureapp_attack", "secureapp_es_field_mappings", "security_content_ctime", "security_content_summariesonly", "security_group_activity_baseline", "security_group_api_calls", "security_services_lookup", + "splunk_crash_log", + "splunk_python", + "splunk_risky_command", + "splunkd", + "splunkd_failed_auths", + "splunkd_investigation_rest_handler", + "splunkd_ui", + "splunkd_web", + "splunkd_webs", + "splunkd_webx", + "splunkda", "sslbl_ssl_certificate_blacklist", "stream_dns", "stream_http", @@ -3178,6 +3264,7 @@ "typo_squatted_python_packages", "uacbypass_process_name", "uncommon_processes", + "windchill_log4j", "windows_exchange_iis", "windows_protocol_handlers", "windows_shells", diff --git a/schemas/Story.schema.json b/schemas/Story.schema.json index 74eb40bd23..b7b727d52b 100644 --- a/schemas/Story.schema.json +++ b/schemas/Story.schema.json @@ -18,6 +18,9 @@ "applockereventcodes", "asr_rules", "attacker_tools", + "audit_searches", + "audittrail", + "aws_bedrock_claude", "aws_cloudwatchlogs_eks", "aws_config", "aws_description", @@ -38,6 +41,7 @@ "brand_abuse_dns", "brand_abuse_email", "brand_abuse_web", + "bro_ssl_json", "browser_app_list", "browser_process_and_path", "builtin_groups_lookup", @@ -49,6 +53,7 @@ "cisco_asa", "cisco_duo_activity", "cisco_duo_administrator", + "cisco_ios", "cisco_isovalent", "cisco_isovalent_allowed_images", "cisco_isovalent_process_connect", @@ -57,6 +62,8 @@ "cisco_networks", "cisco_sd_wan_service_proxy_access", "cisco_sd_wan_syslog", + "cisco_secure_access_dns", + "cisco_secure_access_proxy", "cisco_secure_firewall", "cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools", "cisco_secure_firewall_filetype_lookup", @@ -180,6 +187,7 @@ "osquery_macro", "osquery_process", "papercutng", + "path_traversal_spl_injection", "pingid", "potential_password_in_username_false_positive_reduction", "potentially_malicious_code_on_cmdline_tokenize_score", @@ -292,12 +300,24 @@ "s3_accesslogs", "s3_deletion_baseline", "scripting_tools_user_agents", + "secureapp_attack", "secureapp_es_field_mappings", "security_content_ctime", "security_content_summariesonly", "security_group_activity_baseline", "security_group_api_calls", "security_services_lookup", + "splunk_crash_log", + "splunk_python", + "splunk_risky_command", + "splunkd", + "splunkd_failed_auths", + "splunkd_investigation_rest_handler", + "splunkd_ui", + "splunkd_web", + "splunkd_webs", + "splunkd_webx", + "splunkda", "sslbl_ssl_certificate_blacklist", "stream_dns", "stream_http", @@ -319,6 +339,7 @@ "typo_squatted_python_packages", "uacbypass_process_name", "uncommon_processes", + "windchill_log4j", "windows_exchange_iis", "windows_protocol_handlers", "windows_shells", diff --git a/stories/suspicious_aws_bedrock_claude_activities.yml b/stories/suspicious_aws_bedrock_claude_activities.yml new file mode 100644 index 0000000000..90940a5a5b --- /dev/null +++ b/stories/suspicious_aws_bedrock_claude_activities.yml @@ -0,0 +1,20 @@ +name: Suspicious AWS Bedrock Claude Activities +id: c155d248-406d-48c7-9dd4-1c35607242e0 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +version: 1 +author: Rod Soto, Splunk +status: production +description: This analytic story provides detection coverage for prompt injection, jailbreak attempts and other suspicious activities targeting AWS Bedrock Claude AI services. It monitors user inputs to Claude models for known manipulation patterns such as instruction override phrases, persona hijacking, and safety bypass keywords. These techniques are commonly used by adversaries to circumvent AI safety controls, extract sensitive information, or repurpose the model for malicious tasks. +narrative: This analytic story is designed to detect suspicious activities related to AWS Bedrock Claude, an AI service that allows users to interact with AI models. The story focuses on identifying potential malicious inputs that aim to manipulate the AI model's behavior. By monitoring for specific patterns in user inputs, security teams can identify and respond to potential abuse or exploitation of the AWS Bedrock Claude service. Security teams should review the context of detected prompts to determine if they represent actual prompt injection attempts or benign usage, as false positives may arise from legitimate user interactions with the AI model. +references: +- https://research.splunk.com/stories/aws_bedrock_security/ +- https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ +- https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock +category: +- Adversary Tactics +product: +- Splunk Enterprise +- Splunk Enterprise Security +- Splunk Cloud +usecase: Advanced Threat Detection From 6cba894a01b5d77c1dc81e6c4f478dfb83eae3e1 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 7 Jul 2026 10:48:50 -0700 Subject: [PATCH 026/164] revert to contentctl-ng 1.0.1 to resolve (#4154) an internal tooling issue --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 628e150e83..35b3af07a5 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -contentctl-ng==1.0.2 +contentctl-ng==1.0.1 From 50c889643b3d3eaccb1f45610329eb04e7acd51e Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Tue, 7 Jul 2026 17:12:54 -0400 Subject: [PATCH 027/164] Integration 6.2.0 fixes (#4155) * fixrisk * fixriskmessage --- ...sk_filesystem_and_exec_tool_invocation.yml | 128 ++++++------------ 1 file changed, 45 insertions(+), 83 deletions(-) diff --git a/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml b/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml index c4208b67b7..d89921d281 100644 --- a/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml +++ b/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml @@ -12,97 +12,59 @@ data_source: search: |- `aws_bedrock_claude` | spath output="tool_called" path="output.outputBodyJson{}.content_block.toolUse.name" - | spath output="out_tokens_stream" path="output.outputBodyJson{}.usage.output_tokens" - | where tool_called IN ("bash", "curl", "edit", "write", "webfetch", "grep", "read", "read_file") - | eval out_tokens = coalesce(mvindex('out_tokens_stream', -1), 'output.outputBodyJson.usage.output_tokens', 'output.outputBodyJson.usage.outputTokens', 0) + | spath output="out_tokens_stream" path="output.outputBodyJson{}.usage.output_tokens" + | where tool_called IN ("bash","curl","edit","write","webfetch","grep","read","read_file") + | eval out_tokens = coalesce(mvindex('out_tokens_stream', -1), 'output.outputTokenCount', 0) | eval in_tokens = coalesce('input.inputTokenCount', 0) | eval user_session = replace('identity.arn', ".*/", "") | eval identity_type = case( 'identity.arn' LIKE "%botocore-session%", "automated", 'identity.arn' LIKE "%assumed-role%", "assumed_role", 'identity.arn' LIKE "%user%", "iam_user", - true(), "other" - ) + true(), "other") | stats - count AS invocations, - dc(tool_called) AS unique_tools_used, - sum(in_tokens) AS total_input_tokens, - sum(out_tokens) AS total_output_tokens, - values(tool_called) AS tools_invoked, - values(identity.arn) AS caller_list, - values(user_session) AS user_sessions, - values(identity_type) AS identity_types, - dc(identity.arn) AS unique_callers, - min(_time) AS first_seen, - max(_time) AS last_seen - BY modelId, region + count AS invocations, + dc(tool_called) AS unique_tools_used, + sum(in_tokens) AS total_input_tokens, + sum(out_tokens) AS total_output_tokens, + values(tool_called) AS tools_invoked, + values('identity.arn') AS caller_list, + values(identity_type) AS identity_types, + dc('identity.arn') AS unique_callers, + min(_time) AS first_seen, + max(_time) AS last_seen + BY modelId, region, user_session | eval tokens_per_call = round(total_output_tokens / invocations, 0) - | eval first_seen = strftime(first_seen - 28800, "%Y-%m-%d %H:%M:%S") - | eval last_seen = strftime(last_seen - 28800, "%Y-%m-%d %H:%M:%S") - | eval user = mvjoin(user_sessions, ", ") - | eval risk_score = case( - mvfind(tools_invoked, "bash") >= 0 - AND mvfind(tools_invoked, "curl") >= 0, "CRITICAL", - mvfind(tools_invoked, "bash") >= 0 - AND mvfind(tools_invoked, "write") >= 0, "CRITICAL", - mvfind(tools_invoked, "curl") >= 0 - AND mvfind(tools_invoked, "edit") >= 0, "CRITICAL", - mvfind(identity_types, "assumed_role") >= 0 - AND mvfind(tools_invoked, "bash") >= 0, "CRITICAL", - mvfind(tools_invoked, "bash") >= 0, "HIGH", - mvfind(tools_invoked, "curl") >= 0, "HIGH", - mvfind(tools_invoked, "edit") >= 0, "HIGH", - mvfind(tools_invoked, "write") >= 0, "HIGH", - mvfind(tools_invoked, "webfetch") >= 0, "HIGH", - unique_tools_used >= 3, "HIGH", - true(), "MEDIUM" - ) + | eval first_seen = strftime(first_seen - 28800, "%Y-%m-%d %H:%M:%S") + | eval last_seen = strftime(last_seen - 28800, "%Y-%m-%d %H:%M:%S") + | eval user = user_session + | eval severity = case( + mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "curl") >= 0, "critical", + mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "write") >= 0, "critical", + mvfind(tools_invoked, "curl") >= 0 AND mvfind(tools_invoked, "edit") >= 0, "critical", + mvfind(identity_types, "assumed_role") >= 0 AND mvfind(tools_invoked, "bash") >= 0, "critical", + mvfind(tools_invoked, "bash") >= 0, "high", + mvfind(tools_invoked, "curl") >= 0, "high", + mvfind(tools_invoked, "edit") >= 0, "high", + mvfind(tools_invoked, "write") >= 0, "high", + mvfind(tools_invoked, "webfetch") >= 0, "high", + unique_tools_used >= 3, "high", + true(), "medium") | eval risk_reason = case( - mvfind(tools_invoked, "bash") >= 0 - AND mvfind(tools_invoked, "curl") >= 0, - "bash and curl invoked together - possible download and execute chain", - mvfind(tools_invoked, "bash") >= 0 - AND mvfind(tools_invoked, "write") >= 0, - "bash and write invoked together - possible execution and persistence chain", - mvfind(tools_invoked, "curl") >= 0 - AND mvfind(tools_invoked, "edit") >= 0, - "curl and edit invoked together - possible remote content retrieval and file modification", - mvfind(identity_types, "assumed_role") >= 0 - AND mvfind(tools_invoked, "bash") >= 0, - "Human identity invoking bash via AI model - direct shell execution risk", - mvfind(tools_invoked, "bash") >= 0, - "bash invoked via Bedrock Claude - shell execution through AI model", - mvfind(tools_invoked, "curl") >= 0, - "curl invoked via Bedrock Claude - network call through AI model", - mvfind(tools_invoked, "edit") >= 0, - "edit invoked via Bedrock Claude - file modification through AI model", - mvfind(tools_invoked, "write") >= 0, - "write invoked via Bedrock Claude - file write through AI model", - mvfind(tools_invoked, "webfetch") >= 0, - "webfetch invoked via Bedrock Claude - remote content retrieval through AI model", - unique_tools_used >= 3, - "Broad filesystem and execution tool set invoked via AI model - reconnaissance pattern", - true(), - "Filesystem tool invoked via Bedrock Claude" - ) - | table - risk_score, - risk_reason, - modelId, - region, - unique_callers, - unique_tools_used, - user, - caller_list, - identity_types, - invocations, - tools_invoked, - total_input_tokens, - total_output_tokens, - tokens_per_call, - first_seen, - last_seen - | sort -risk_score, -unique_tools_used, -invocations + mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "curl") >= 0, "bash and curl invoked together - possible download and execute chain", + mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "write") >= 0, "bash and write invoked together - possible execution and persistence chain", + mvfind(tools_invoked, "curl") >= 0 AND mvfind(tools_invoked, "edit") >= 0, "curl and edit invoked together - possible remote content retrieval and file modification", + mvfind(identity_types, "assumed_role") >= 0 AND mvfind(tools_invoked, "bash") >= 0, "Human identity invoking bash via AI model - direct shell execution risk", + mvfind(tools_invoked, "bash") >= 0, "bash invoked via Bedrock Claude - shell execution through AI model", + mvfind(tools_invoked, "curl") >= 0, "curl invoked via Bedrock Claude - network call through AI model", + mvfind(tools_invoked, "edit") >= 0, "edit invoked via Bedrock Claude - file modification through AI model", + mvfind(tools_invoked, "write") >= 0, "write invoked via Bedrock Claude - file write through AI model", + mvfind(tools_invoked, "webfetch") >= 0, "webfetch invoked via Bedrock Claude - remote content retrieval through AI model", + unique_tools_used >= 3, "Broad filesystem and execution tool set invoked via AI model - reconnaissance pattern", + true(), "Filesystem tool invoked via Bedrock Claude") + | where severity IN ("critical","high") + | table severity, risk_reason, modelId, region, user,unique_tools_used, caller_list, identity_types, invocations, tools_invoked, total_input_tokens, total_output_tokens, tokens_per_call, first_seen, last_seen + | sort -unique_tools_used, -invocations | `aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation_filter` how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. known_false_positives: This detection may produce false positives for legitimate developer activity where authorized users invoke shell execution, file write, or network tools through Claude Code as part of normal software development, deployment automation, or infrastructure management workflows. @@ -125,7 +87,7 @@ intermediate_findings: - field: user type: user score: 50 - message: Identity $user$ invoked high-risk filesystem and execution tools $tools_invoked$ via AWS Bedrock Claude with risk score $risk_score$ and reason $risk_reason$. + message: Identity $user$ invoked high-risk filesystem and execution tools $tools_invoked$ via AWS Bedrock Claude with severity $severity$ and reason $risk_reason$. analytic_story: - Suspicious AWS Bedrock Claude Activities asset_type: Web Application From 80d1b810ae9b21d07d81be40c7351b6e11c5d8d1 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Wed, 8 Jul 2026 18:31:00 +0200 Subject: [PATCH 028/164] Fix Incorrect Escape (#4159) --- ...from_password_stores_chrome_login_data_access.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 44a44a2432..57cf84d660 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -2,7 +2,7 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf version: 23 creation_date: '2023-05-02' -modification_date: '2026-06-25' +modification_date: '2026-07-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -21,11 +21,11 @@ search: | NOT process_path IN ( "*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", - "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\\chrome.exe", - "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\\chrome.exe", - "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\\chrome.exe", - "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\\chrome.exe", - "*\\AppData\\Local\\Google\\Chrome\\Application\\\chrome.exe" + "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe" ) | stats count min(_time) as firstTime max(_time) as lastTime From b5a88d52587903db5b190fe66f72cb22725bb00d Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bpatel@splunk.com> Date: Fri, 10 Jul 2026 01:45:31 +0530 Subject: [PATCH 029/164] hotfix --- ..._rce_through_arbitrary_file_write_to_windows_system_root.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml index 74c716a688..21114c3d1f 100644 --- a/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml +++ b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml @@ -6,7 +6,7 @@ modification_date: '2026-06-23' author: Rod Soto status: production type: Hunting -description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration. +description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration data_source: - Splunk search: |- From 04320eac5a23ecedd190cb7b22373f74466ddd53 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Tue, 14 Jul 2026 23:50:09 +0530 Subject: [PATCH 030/164] chore: bump contentctl.yml and build.yml to 6.3.0 (#4165) Co-authored-by: research bot <research@splunk.com> --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index cca64df09e..d0447873f6 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.2.0 +app_version: 6.3.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index abb5d9c6ab..c7d57446e8 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.2.0 + version: 6.3.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From dc384ffdd9335e33d9dcd4ea51375c65b12b38f2 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Tue, 14 Jul 2026 23:51:39 +0530 Subject: [PATCH 031/164] Bug Fix - Suspicious Process Executed From Container File (#4161) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- ...s_process_executed_from_container_file.yml | 57 +++++++++++++++++-- 1 file changed, 52 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/suspicious_process_executed_from_container_file.yml b/detections/endpoint/suspicious_process_executed_from_container_file.yml index 3699a2dfcd..714db930e4 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file.yml @@ -1,8 +1,8 @@ name: Suspicious Process Executed From Container File id: d8120352-3b62-411c-8cb6-7b47584dd5e8 -version: 11 +version: 12 creation_date: '2023-07-11' -modification_date: '2026-05-13' +modification_date: '2026-07-09' author: Steven Dick status: production type: TTP @@ -11,7 +11,50 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*") AND Processes.action="allowed" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$" | rex field=process "(?i).+\\\\(?<file_name>[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?<process_name>.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$"| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_executed_from_container_file_filter`' +search: |- + | tstats `security_content_summariesonly` + count + min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Processes + where Processes.process IN ( + "*.ZIP\\*", + "*.ISO\\*", + "*.IMG\\*", + "*.CAB\\*", + "*.TAR\\*", + "*.GZ\\*", + "*.RAR\\*", + "*.7Z\\*" + ) + AND Processes.action="allowed" + by + Processes.action + Processes.dest + Processes.original_file_name + Processes.parent_process + Processes.parent_process_exec + Processes.parent_process_guid + Processes.parent_process_id + Processes.parent_process_name + Processes.parent_process_path + Processes.process + Processes.process_exec + Processes.process_guid + Processes.process_hash + Processes.process_id + Processes.process_integrity_level + Processes.process_name + Processes.process_path + Processes.user + Processes.user_id + Processes.vendor_product + | `drop_dm_object_name(Processes)` + | regex process="(?i).*\.(zip|iso|img|cab|tar|gz|rar|7z)\\\\.+\.(bat|bin|cab|cmd|com|cpl|ex_|exe|gadget|inf1|ins|inx|htm|html|isu|jar|job|js|jse|lnk|msc|msi|msp|mst|paf|pif|ps1|reg|rgs|scr|sct|shb|shs|u3p|vb|vbe|vbs|vbscript|ws|wsf|wsh)\"?$" + | rex field=process "(?i).+\\\\(?<file_name>[^\\\\]+\.(?:zip|iso|img|cab|tar|gz|rar|7z))\\\\(?:.+\\\\)?(?<container_file_name>[^\\\\\"]+\.(?:bat|bin|cab|cmd|com|cpl|ex_|exe|gadget|inf1|ins|inx|htm|html|isu|jar|job|js|jse|lnk|msc|msi|msp|mst|paf|pif|ps1|reg|rgs|scr|sct|shb|shs|u3p|vb|vbe|vbs|vbscript|ws|wsf|wsh))\"?$" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_process_executed_from_container_file_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Various business process or userland applications and behavior. references: @@ -28,7 +71,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: A suspicious process $process_name$ was launched from $file_name$ on $dest$. + title: A suspicious file [$container_file_name$] was launched from container file [$file_name$] by process [$process_name$] on [$dest$]. entity: field: user type: user @@ -38,10 +81,14 @@ intermediate_findings: - field: dest type: system score: 50 - message: A suspicious process $process_name$ was launched from $file_name$ on $dest$. + message: A suspicious file [$container_file_name$] was launched from container file [$file_name$] by process [$process_name$] on [$dest$]. threat_objects: + - field: process_name + type: process_name - field: file_name type: file_name + - field: container_file_name + type: file_name analytic_story: - APT37 Rustonotto and FadeStealer - GhostRedirector IIS Module and Rungan Backdoor From 81fa0144374e62cd9f176964397eccd9a97fb36e Mon Sep 17 00:00:00 2001 From: Lou Stella <ljstella@gmail.com> Date: Tue, 14 Jul 2026 14:31:17 -0400 Subject: [PATCH 032/164] Only run unit-testing when there's something to test (#4151) Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .github/workflows/unit-testing.yml | 39 +++++++++++++++++------------- 1 file changed, 22 insertions(+), 17 deletions(-) diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 39f11ee0b2..c15bbc1aa3 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -2,6 +2,11 @@ name: unit-testing on: pull_request: types: [opened, reopened, synchronize] + paths: + - detections/** + - data_sources/** + - lookups/** + - macros/** jobs: unit-testing: runs-on: large-ubuntu-22.04-32core @@ -13,7 +18,7 @@ jobs: with: repository: 'splunk/security_content' #this should be the TARGET repo of the PR. we hardcode it for now ref: ${{ github.base_ref }} - + - name: Print out information abour PR target run: | echo "The PR target branch is: ${{ github.base_ref }}" @@ -21,8 +26,8 @@ jobs: echo "My current branch is" git branch --show-current git rev-parse HEAD - - + + - name: Set up Python uses: actions/setup-python@v6 with: @@ -34,38 +39,38 @@ jobs: run: | echo "- Build Tool Version - $(cat requirements.txt)" pip install -r requirements.txt - + # Check out the PR, even if it lives in a fork. - # Instructions for pulling a PR were taken from: + # Instructions for pulling a PR were taken from: # https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally - name: Checkout the PR branch and the target to calculate changed files for testing run: | - + echo "Current Branch (Head Ref): ${{ github.head_ref }}" echo "Target Branch (Base Ref): ${{ github.base_ref }}" git pull > /dev/null 2>&1 #We checkout into a new branch - new_branch_for_testing to avoid name collisions with develop incase the forked PR is from develop git fetch origin pull/${{ github.event.pull_request.number }}/head:new_branch_for_testing - #We must specifically get the PR's target branch from security_content, not the one that resides in the fork PR's forked repo + #We must specifically get the PR's target branch from security_content, not the one that resides in the fork PR's forked repo git switch new_branch_for_testing - + - name: Run a contentctl-ng build command to create a package that will be tested. run: | contentctl-ng build - + - name: Start the test environment run: | docker run -d --platform linux/amd64 -p 8088:8088 -p 8089:8089 -p 8000:8000 -e 'SPLUNK_START_ARGS=--accept-license' -e 'SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com' -e 'SPLUNK_PASSWORD=Chang3d!' --name splunk splunk/splunk:latest # Wait some time for this environment to be ready sleep 180 - + - name: Run a contentctl-ng install to configure the testing environment env: APPINSPECTUSERNAME: "${{ secrets.APPINSPECTUSERNAME }}" - APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}" + APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}" run : | - contentctl-ng install --splunkbase-username "$APPINSPECTUSERNAME" --splunkbase-password "$APPINSPECTPASSWORD" - + contentctl-ng install --splunkbase-username "$APPINSPECTUSERNAME" --splunkbase-password "$APPINSPECTPASSWORD" + - name: Test content which has changed between this branch and the target branch run: | contentctl-ng test --verbose --post-test-behavior NEVER_PAUSE --mode CHANGED --git-ref ${{ github.base_ref }} @@ -81,7 +86,7 @@ jobs: test_results/summary.yml dist/*.tar.gz - # Print entire result summary so that the users can view it in the Github Actions logs + # Print entire result summary so that the users can view it in the Github Actions logs - name: Print entire test_results/summary.yml if: always() run: cat test_results/summary.yml @@ -89,7 +94,7 @@ jobs: # Run a simple custom script created to pretty print results in a markdown friendly format in Github Actions Summary - name: Check the test_results/summary.yml for pass/fail. if: always() - run: | - echo "This job will fail if there are failures in unit-testing" + run: | + echo "This job will fail if there are failures in unit-testing" python .github/workflows/format_test_results.py >> $GITHUB_STEP_SUMMARY - echo "The Unit testing is completed. See details in the unit-testing job summary UI " \ No newline at end of file + echo "The Unit testing is completed. See details in the unit-testing job summary UI " From 91ed6a5dff2a626b0b6665a9986608fd5d4a8bb3 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 15 Jul 2026 18:22:04 +0530 Subject: [PATCH 033/164] Update Macro Definition - `secureapp_es_field_mappings` (#4158) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- macros/secureapp_es_field_mappings.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/macros/secureapp_es_field_mappings.yml b/macros/secureapp_es_field_mappings.yml index 75433b4705..0c6caba509 100644 --- a/macros/secureapp_es_field_mappings.yml +++ b/macros/secureapp_es_field_mappings.yml @@ -1,8 +1,8 @@ name: secureapp_es_field_mappings id: 6feb2b98-3da5-478b-8f97-c85b29c98885 -version: 1 +version: 2 creation_date: '2025-08-04' -modification_date: '2026-05-13' +modification_date: '2026-07-08' author: Splunk Threat Research Team -description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. -definition: '| eval rule_number=attackName | eval app=app_name | eval action=attackOutcome | eval view=blockedReason | eval product=btName | eval ids_type=eventType | eval process=jvmId | eval cve=matchedCveName | eval record_type=ptype | eval ip=socketAddr | eval package_title=tierName | eval signature_id=vulnerableMethod | eval url=webTransactionUrl | eval location=applicationId | eval package=tierId | eval rule_number=attackId | eval mode=attackStatus' +description: This macro helps normalize logs from Csico Secure App field names to CIM (Common Information Model) compliant field names. Customize the macro definition as needed for your Splunk environment. +definition: '| eval location=url | eval ip=socketOut | eval gid=coalesce(attackName,attackId) | eval action=attackOutcome | eval view=blockedReason | eval ids_type=eventType | eval process=jvmId | eval cve=matchedCveName | eval signature_id=vulnerableMethod | eval url=webTransactionUrl | eval mode=attackStatus | eval src_category=attackSource | eval dest_ip=serverAddress | eval dest_nt_host=serverName | eval dest_port=serverPort | eval signature=attackTypes | eval src_ip=clientAddress | eval src_port=clientPort | eval record_type=ptype | eval app=coalesce(application,environment) | eval product=attackBusinessTransaction | eval package_title=coalesce(tier,service) | eval package=coalesce(tierId,serviceId) | eval rule_number=name | eval object_name=keyInfo | eval file_path=workingDir | eval file_name=filename | eval session_id=sql | eval attacktypecount=mvcount(attackTypes)' From d965a40083ea5266b56b722427d8f0b82b81c2dd Mon Sep 17 00:00:00 2001 From: Tessa Georgen <67936042+tjgeorgen@users.noreply.github.com> Date: Thu, 16 Jul 2026 02:40:49 -0400 Subject: [PATCH 034/164] use contentctl-ng 1.0.2 update-data-source-tas command to create data source and install.yml app version update PRs (#4143) --- .github/workflows/datasource-dependabot.yml | 43 +++++---- .github/workflows/update_data_sources_ta.py | 98 --------------------- requirements.txt | 2 +- 3 files changed, 21 insertions(+), 122 deletions(-) delete mode 100644 .github/workflows/update_data_sources_ta.py diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 0841808720..654ac85d84 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -6,7 +6,7 @@ on: - cron: '55 06 * * *' # Runs daily at midnight jobs: - data-source-validation-and-update: + update-data-source-tas-and-install-yml-apps: runs-on: ubuntu-latest steps: @@ -15,44 +15,41 @@ jobs: with: ref: 'develop' token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} - + - name: Set up Python uses: actions/setup-python@v6 with: - python-version: '3.11' + python-version: '3.14' architecture: 'x64' # or the version your script requires - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | echo "- Contentctl version - $(cat requirements.txt)" pip install -r requirements.txt - - - name: Run ContentCTL Data source TA validation - id: validate - run: | - pwd - contentctl validate --data-source-TA-validation 2>&1 | tee data_source_validation.log - continue-on-error: true - - - name: Print Validation Log - run: | - cat data_source_validation.log - rm -f =4.0.0 - - name: Update Data Sources if Validation Fails + - name: Update data source TAs and install.yml apps run: | - python .github/workflows/update_data_sources_ta.py - git status + echo "Updating data source supported_TA and repo install.yml app versions" + contentctl-ng update-data-source-tas --content-dirs . + echo "Changed data source and install.yml files:" + git status --short -- data_sources install.yml - - name: Create Pull Request + - name: Create data source TA and install.yml app update pull request uses: peter-evans/create-pull-request@v8 with: token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} - commit-message: Updated TAs + commit-message: Update data source TA and install.yml app versions branch: auto-ta-update-${{ github.run_number }} base: develop - title: Automated Splunk TA Update ${{ github.run_number }} - body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow." + title: Automated Data Source TA and install.yml App Update ${{ github.run_number }} + body: | + This PR contains data source supported_TA and install.yml app version updates generated by contentctl-ng. + + The workflow runs: + + ```bash + contentctl-ng update-data-source-tas --content-dirs . + ``` add-paths: | data_sources/** - contentctl.yml + install.yml diff --git a/.github/workflows/update_data_sources_ta.py b/.github/workflows/update_data_sources_ta.py deleted file mode 100644 index 77ae138a3e..0000000000 --- a/.github/workflows/update_data_sources_ta.py +++ /dev/null @@ -1,98 +0,0 @@ -import os -import yaml -from collections import OrderedDict - -# Custom YAML loader to preserve the order of keys -class OrderedLoader(yaml.SafeLoader): - pass - -def construct_mapping(loader, node): - loader.flatten_mapping(node) - return OrderedDict(loader.construct_pairs(node)) - -OrderedLoader.add_constructor( - yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, - construct_mapping -) - -# Custom YAML dumper to preserve the order of keys -class OrderedDumper(yaml.SafeDumper): - pass - -def dict_representer(dumper, data): - return dumper.represent_dict(data.items()) - -OrderedDumper.add_representer(OrderedDict, dict_representer) - -# Define the paths -log_file_path = 'data_source_validation.log' -data_sources_dir = 'data_sources' -contentctl_file_path = 'contentctl.yml' - -def update_data_sources(ta_name, latest_version): - # Update the YAML files in the data sources directory - for filename in os.listdir(data_sources_dir): - if filename.endswith('.yml'): - file_path = os.path.join(data_sources_dir, filename) - with open(file_path, 'r') as yml_file: - data = yaml.load(yml_file, Loader=OrderedLoader) - - # Check if the TA name matches and update the version - updated = False - for ta in data.get('supported_TA', []): - if ta['name'] == ta_name: - if ta['version'] != latest_version: - ta['version'] = latest_version - updated = True - - # Write the updated data back to the YAML file - if updated: - with open(file_path, 'w') as yml_file: - yaml.dump(data, yml_file, Dumper=OrderedDumper) - -def update_contentctl_yml(title, new_version): - # Load the existing YAML file - with open(contentctl_file_path, 'r') as file: - content = yaml.load(file, Loader=OrderedLoader) - - # Iterate over the apps to find the title and update the version and hardcoded_path - updated = False - for app in content.get('apps', []): - if app.get('title') == title: - if app.get('version') != new_version: - app['version'] = new_version - updated = True - print(f"Updated {title} in contentctl.yml to version {new_version}") - - # Update the hardcoded_path if it exists - if 'hardcoded_path' in app: - base_url, current_version = app['hardcoded_path'].rsplit('_', 1) - new_hardcoded_path = f"{base_url}_{new_version.replace('.', '')}.tgz" - app['hardcoded_path'] = new_hardcoded_path - print(f"Updated hardcoded_path for {title} to {new_hardcoded_path}") - - # Write the updated content back to the YAML file if changes were made - if updated: - with open(contentctl_file_path, 'w') as file: - yaml.dump(content, file, Dumper=OrderedDumper, default_flow_style=False) - -def main(): - # Read the log file to find version mismatches - with open(log_file_path, 'r') as log_file: - log_lines = log_file.readlines() - - # Parse the log file to find the TA name and the latest version - for i, line in enumerate(log_lines): - if 'Version mismatch' in line: - ta_name = log_lines[i].split("'")[3].strip() - latest_version = log_lines[i + 1].split(':')[1].strip() - print(f"Found version mismatch for TA: {ta_name}, updating to version: {latest_version}") - - # Update data sources and contentctl.yml - update_data_sources(ta_name, latest_version) - update_contentctl_yml(ta_name, latest_version) - - print("Version updates completed.") - -if __name__ == "__main__": - main() \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 35b3af07a5..628e150e83 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -contentctl-ng==1.0.1 +contentctl-ng==1.0.2 From d51afa603f239066524e71e0ce5427013d22cdd7 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 16 Jul 2026 03:29:14 -0700 Subject: [PATCH 035/164] Align STDDevs description with search (#4160) --------- Co-authored-by: Bhavin Patel <bpatel@splunk.com> --- .../aws_bedrock_claude_unusually_large_prompts.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml index 26e7229ac4..9d1123e530 100644 --- a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml +++ b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml @@ -1,16 +1,16 @@ name: AWS Bedrock Claude Unusually Large Prompts id: 95fbdd4e-1202-4971-b85a-513b2005086e -version: 1 +version: 2 author: Rod Soto status: production type: Anomaly creation_date: '2026-07-06' -modification_date: '2026-07-06' +modification_date: '2026-07-08' security_domain: endpoint data_source: - AWS Bedrock Claude category: application -description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed 15 standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service. +description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service. search: |- `aws_bedrock_claude` | rename "input.inputTokenCount" AS input_tokens From 83fbcedcc427a6a1a014a8d7df2c91420882335e Mon Sep 17 00:00:00 2001 From: Andrei Banaru <andrei.banaru@gmail.com> Date: Fri, 17 Jul 2026 14:36:50 +0200 Subject: [PATCH 036/164] Update "Short Lived Scheduled Task" (#4152) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .../endpoint/short_lived_scheduled_task.yml | 54 +++++++++++-------- 1 file changed, 31 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml index 6bfbaf2cbb..e95de1b7ae 100644 --- a/detections/endpoint/short_lived_scheduled_task.yml +++ b/detections/endpoint/short_lived_scheduled_task.yml @@ -1,26 +1,34 @@ name: Short Lived Scheduled Task id: 6fa31414-546e-11ec-adfa-acde48001122 -version: 11 +version: 12 creation_date: '2021-12-03' -modification_date: '2026-05-13' +modification_date: '2026-07-07' author: Mauricio Velazco, Splunk status: production -type: TTP -description: The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699. This behavior is identified by analyzing Windows Security Event Logs and leveraging the Windows TA for parsing. Such activity is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or execution of malicious payloads, necessitating prompt investigation and response by security analysts. +type: Anomaly +description: |- + The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699. + This behavior is identified by analyzing Windows Security Event Logs and leveraging the Windows TA for parsing. + Such activity may indicate lateral movement or remote code execution attempts by adversaries. + If confirmed malicious, this could lead to unauthorized access, data exfiltration, or execution of malicious payloads, necessitating prompt investigation and response by security analysts. data_source: - Windows Event Log Security 4698 - Windows Event Log Security 4699 search: |- - `wineventlog_security` EventCode=4698 OR EventCode=4699 - | xmlkv Message - | transaction Task_Name startswith=(EventCode=4698) endswith=(EventCode=4699) - | eval short_lived=case((duration<30),"TRUE") - | search short_lived = TRUE - | rename ComputerName as dest - | table _time, dest, Account_Name, Command, Task_Name, short_lived - | `short_lived_scheduled_task_filter` -how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. -known_false_positives: Although uncommon, legitimate applications may create and delete a Scheduled Task within 30 seconds. Filter as needed. + `wineventlog_security` + EventCode IN (4698, 4699) + | xmlkv object_attrs + | transaction TaskName dest startswith=(EventCode=4698) endswith=(EventCode=4699) maxspan=30s + | stats count min(_time) AS firstTime + max(_time) AS lastTime + by Command TaskName user dest RunLevel + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `short_lived_scheduled_task_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. +known_false_positives: |- + Although uncommon, legitimate applications may create and delete a Scheduled Task within 30 seconds. Filter as needed. references: - https://attack.mitre.org/techniques/T1053/005/ - https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler @@ -33,12 +41,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A windows scheduled task was created and deleted in 30 seconds on $dest$ - entity: - field: dest - type: system - score: 50 +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A windows scheduled task [$TaskName$] with the command [$Command$] was created by [$user$] and deleted in less than 30 seconds on [$dest$] analytic_story: - Active Directory Lateral Movement - CISA AA22-257A @@ -57,7 +65,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security-task.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog test_type: unit From a9d1e1afe33fd3d50dcef6c9ab07fe531acc9a89 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Mon, 20 Jul 2026 18:14:58 +0530 Subject: [PATCH 037/164] Update data source TA and install.yml app versions (#4171) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/aws_bedrock_claude.yml | 87 +++-- data_sources/azure_active_directory.yml | 2 +- ...p_role_assignment_to_service_principal.yml | 2 +- ...re_active_directory_add_member_to_role.yml | 2 +- ...ive_directory_add_owner_to_application.yml | 2 +- ...active_directory_add_service_principal.yml | 2 +- ...active_directory_add_unverified_domain.yml | 2 +- ...ctive_directory_consent_to_application.yml | 2 +- ...irectory_disable_strong_authentication.yml | 2 +- .../azure_active_directory_enable_account.yml | 2 +- ..._active_directory_invite_external_user.yml | 2 +- ...e_directory_microsoftgraphactivitylogs.yml | 2 +- ...directory_noninteractiveusersigninlogs.yml | 2 +- ...ve_directory_reset_password_(by_admin).yml | 2 +- ...ve_directory_set_domain_authentication.yml | 2 +- ...zure_active_directory_sign_in_activity.yml | 2 +- ...re_active_directory_update_application.yml | 2 +- ..._directory_update_authorization_policy.yml | 2 +- .../azure_active_directory_update_user.yml | 2 +- ...irectory_user_registered_security_info.yml | 2 +- ..._or_update_an_azure_automation_account.yml | 2 +- ..._or_update_an_azure_automation_runbook.yml | 2 +- ..._or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- data_sources/cisco_ai_defense_alerts.yml | 2 +- data_sources/cisco_asa_logs.yml | 2 +- data_sources/cisco_duo_activity.yml | 2 +- data_sources/cisco_duo_administrator.yml | 2 +- data_sources/cisco_ios_logs.yml | 2 +- .../cisco_isovalent_process_connect.yml | 2 +- data_sources/cisco_isovalent_process_exec.yml | 2 +- .../cisco_isovalent_process_kprobe.yml | 2 +- data_sources/cisco_secure_access_dns.yml | 212 +++++------ data_sources/cisco_secure_access_firewall.yml | 2 +- data_sources/cisco_secure_access_proxy.yml | 352 +++++++++--------- ...rewall_threat_defense_connection_event.yml | 2 +- ...ure_firewall_threat_defense_file_event.yml | 2 +- ...irewall_threat_defense_intrusion_event.yml | 2 +- .../crowdstrike_falcon_stream_alert.yml | 2 +- data_sources/crowdstrike_processrollup2.yml | 2 +- data_sources/g_suite_drive.yml | 2 +- data_sources/g_suite_gmail.yml | 2 +- data_sources/github_enterprise_audit_logs.yml | 2 +- .../github_organizations_audit_logs.yml | 2 +- data_sources/google_workspace.yml | 2 +- .../google_workspace_login_failure.yml | 2 +- .../google_workspace_login_success.yml | 2 +- data_sources/linux_auditd_add_user.yml | 2 +- data_sources/linux_auditd_cwd.yml | 2 +- data_sources/linux_auditd_daemon_abort.yml | 2 +- data_sources/linux_auditd_daemon_end.yml | 2 +- data_sources/linux_auditd_daemon_start.yml | 2 +- data_sources/linux_auditd_execve.yml | 2 +- data_sources/linux_auditd_path.yml | 2 +- data_sources/linux_auditd_proctitle.yml | 2 +- data_sources/linux_auditd_service_stop.yml | 2 +- data_sources/linux_auditd_syscall.yml | 2 +- data_sources/linux_messages_syslog.yml | 87 +++-- data_sources/linux_secure.yml | 2 +- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/okta.yml | 2 +- data_sources/palo_alto_network_threat.yml | 2 +- data_sources/palo_alto_network_traffic.yml | 2 +- .../powershell_script_block_logging_4104.yml | 2 +- data_sources/sysmon_eventid_1.yml | 2 +- data_sources/sysmon_eventid_10.yml | 2 +- data_sources/sysmon_eventid_11.yml | 2 +- data_sources/sysmon_eventid_12.yml | 2 +- data_sources/sysmon_eventid_13.yml | 2 +- data_sources/sysmon_eventid_14.yml | 2 +- data_sources/sysmon_eventid_15.yml | 2 +- data_sources/sysmon_eventid_17.yml | 2 +- data_sources/sysmon_eventid_18.yml | 2 +- data_sources/sysmon_eventid_20.yml | 2 +- data_sources/sysmon_eventid_21.yml | 2 +- data_sources/sysmon_eventid_22.yml | 2 +- data_sources/sysmon_eventid_23.yml | 2 +- data_sources/sysmon_eventid_26.yml | 2 +- data_sources/sysmon_eventid_29.yml | 2 +- data_sources/sysmon_eventid_3.yml | 2 +- data_sources/sysmon_eventid_5.yml | 2 +- data_sources/sysmon_eventid_6.yml | 2 +- data_sources/sysmon_eventid_7.yml | 2 +- data_sources/sysmon_eventid_8.yml | 2 +- data_sources/sysmon_eventid_9.yml | 2 +- .../windows_active_directory_admon.yml | 2 +- .../windows_event_log_application_15457.yml | 2 +- .../windows_event_log_application_17135.yml | 2 +- .../windows_event_log_application_2282.yml | 2 +- .../windows_event_log_application_3000.yml | 2 +- .../windows_event_log_application_8128.yml | 2 +- ...ws_event_log_appxdeployment_server_400.yml | 2 +- ...ws_event_log_appxdeployment_server_854.yml | 2 +- ...ws_event_log_appxdeployment_server_855.yml | 2 +- .../windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- ...ent_log_certificateservicesclient_1007.yml | 2 +- .../windows_event_log_defender_1121.yml | 2 +- .../windows_event_log_defender_1122.yml | 2 +- .../windows_event_log_defender_1125.yml | 2 +- .../windows_event_log_defender_1126.yml | 2 +- .../windows_event_log_defender_1129.yml | 2 +- .../windows_event_log_defender_1131.yml | 2 +- .../windows_event_log_defender_1132.yml | 2 +- .../windows_event_log_defender_1133.yml | 2 +- .../windows_event_log_defender_1134.yml | 2 +- .../windows_event_log_defender_5007.yml | 2 +- .../windows_event_log_printservice_316.yml | 2 +- .../windows_event_log_printservice_4909.yml | 2 +- .../windows_event_log_printservice_808.yml | 2 +- ...event_log_remoteconnectionmanager_1149.yml | 2 +- .../windows_event_log_security_1100.yml | 2 +- .../windows_event_log_security_1102.yml | 2 +- .../windows_event_log_security_4624.yml | 2 +- .../windows_event_log_security_4625.yml | 2 +- .../windows_event_log_security_4627.yml | 2 +- .../windows_event_log_security_4648.yml | 2 +- .../windows_event_log_security_4662.yml | 2 +- .../windows_event_log_security_4663.yml | 2 +- .../windows_event_log_security_4672.yml | 2 +- .../windows_event_log_security_4688.yml | 2 +- .../windows_event_log_security_4698.yml | 2 +- .../windows_event_log_security_4699.yml | 2 +- .../windows_event_log_security_4700.yml | 2 +- .../windows_event_log_security_4702.yml | 2 +- .../windows_event_log_security_4703.yml | 2 +- .../windows_event_log_security_4719.yml | 2 +- .../windows_event_log_security_4720.yml | 2 +- .../windows_event_log_security_4723.yml | 187 +++++----- .../windows_event_log_security_4724.yml | 2 +- .../windows_event_log_security_4725.yml | 2 +- .../windows_event_log_security_4726.yml | 2 +- .../windows_event_log_security_4727.yml | 2 +- .../windows_event_log_security_4728.yml | 2 +- .../windows_event_log_security_4730.yml | 2 +- .../windows_event_log_security_4731.yml | 2 +- .../windows_event_log_security_4732.yml | 2 +- .../windows_event_log_security_4737.yml | 2 +- .../windows_event_log_security_4738.yml | 2 +- .../windows_event_log_security_4739.yml | 2 +- .../windows_event_log_security_4741.yml | 2 +- .../windows_event_log_security_4742.yml | 2 +- .../windows_event_log_security_4744.yml | 2 +- .../windows_event_log_security_4749.yml | 2 +- .../windows_event_log_security_4754.yml | 2 +- .../windows_event_log_security_4756.yml | 2 +- .../windows_event_log_security_4759.yml | 2 +- .../windows_event_log_security_4768.yml | 2 +- .../windows_event_log_security_4769.yml | 2 +- .../windows_event_log_security_4771.yml | 2 +- .../windows_event_log_security_4776.yml | 2 +- .../windows_event_log_security_4781.yml | 2 +- .../windows_event_log_security_4783.yml | 2 +- .../windows_event_log_security_4790.yml | 2 +- .../windows_event_log_security_4794.yml | 2 +- .../windows_event_log_security_4798.yml | 2 +- .../windows_event_log_security_4876.yml | 2 +- .../windows_event_log_security_4886.yml | 2 +- .../windows_event_log_security_4887.yml | 2 +- .../windows_event_log_security_4946.yml | 2 +- .../windows_event_log_security_4947.yml | 2 +- .../windows_event_log_security_4948.yml | 2 +- .../windows_event_log_security_5136.yml | 2 +- .../windows_event_log_security_5137.yml | 2 +- .../windows_event_log_security_5140.yml | 2 +- .../windows_event_log_security_5141.yml | 2 +- .../windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- .../windows_event_log_system_4720.yml | 2 +- .../windows_event_log_system_4726.yml | 2 +- .../windows_event_log_system_4728.yml | 2 +- .../windows_event_log_system_7036.yml | 2 +- .../windows_event_log_system_7040.yml | 2 +- .../windows_event_log_system_7045.yml | 2 +- .../windows_event_log_taskscheduler_200.yml | 2 +- .../windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 181 files changed, 631 insertions(+), 646 deletions(-) diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 1ecc4497cc..bd7fc59c23 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -4,10 +4,7 @@ version: 1 creation_date: '2026-05-20' modification_date: '2026-05-20' author: Rod Soto, Splunk -description: Amazon Bedrock model invocation logs for Claude models. Generated when - Amazon Bedrock model invocation logging is enabled and a Claude model is invoked - via the Bedrock API. Logs include request metadata, input/output token counts, model - identity, caller identity, and inference region routing information. +description: Amazon Bedrock model invocation logs for Claude models. Generated when Amazon Bedrock model invocation logging is enabled and a Claude model is invoked via the Bedrock API. Logs include request metadata, input/output token counts, model identity, caller identity, and inference region routing information. mitre_components: - Application Log Content source: aws_bedrock @@ -17,48 +14,48 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.1 + version: 8.1.2 fields: -- _time -- accountId -- host -- identity.arn -- inferenceRegion -- input.cacheReadInputTokenCount -- input.cacheWriteInputTokenCount -- input.inputBodyJson.anthropic_beta -- input.inputBodyJson.anthropic_version -- input.inputBodyJson.max_tokens -- input.inputBodyJson.messages{}.content{}.text -- input.inputBodyJson.messages{}.content{}.type -- input.inputBodyJson.messages{}.role -- input.inputBodyJson.metadata.user_id -- input.inputBodyJson.system{}.text -- input.inputBodyJson.system{}.type -- input.inputBodyJson.temperature -- input.inputBodyJson.tools -- input.inputContentType -- input.inputTokenCount -- modelId -- operation -- output.outputBodyJson{}.message.id -- output.outputBodyJson{}.message.model -- output.outputBodyJson{}.message.role -- output.outputBodyJson{}.message.stop_reason -- output.outputBodyJson{}.message.usage.cache_creation_input_tokens -- output.outputBodyJson{}.message.usage.cache_read_input_tokens -- output.outputBodyJson{}.message.usage.input_tokens -- output.outputBodyJson{}.message.usage.output_tokens -- output.outputBodyJson{}.type -- output.outputContentType -- output.outputTokenCount -- region -- requestId -- schemaType -- schemaVersion -- source -- sourcetype -- timestamp + - _time + - accountId + - host + - identity.arn + - inferenceRegion + - input.cacheReadInputTokenCount + - input.cacheWriteInputTokenCount + - input.inputBodyJson.anthropic_beta + - input.inputBodyJson.anthropic_version + - input.inputBodyJson.max_tokens + - input.inputBodyJson.messages{}.content{}.text + - input.inputBodyJson.messages{}.content{}.type + - input.inputBodyJson.messages{}.role + - input.inputBodyJson.metadata.user_id + - input.inputBodyJson.system{}.text + - input.inputBodyJson.system{}.type + - input.inputBodyJson.temperature + - input.inputBodyJson.tools + - input.inputContentType + - input.inputTokenCount + - modelId + - operation + - output.outputBodyJson{}.message.id + - output.outputBodyJson{}.message.model + - output.outputBodyJson{}.message.role + - output.outputBodyJson{}.message.stop_reason + - output.outputBodyJson{}.message.usage.cache_creation_input_tokens + - output.outputBodyJson{}.message.usage.cache_read_input_tokens + - output.outputBodyJson{}.message.usage.input_tokens + - output.outputBodyJson{}.message.usage.output_tokens + - output.outputBodyJson{}.type + - output.outputContentType + - output.outputTokenCount + - region + - requestId + - schemaType + - schemaVersion + - source + - sourcetype + - timestamp example_log: '{"timestamp":"2026-05-07T19:43:51Z","accountId":"387769110234","region":"us-west-2","requestId":"eb4b957b-6cbd-4679-8356-3bf3dde4d86e","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/9tr38q319pda","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: cat /etc/passwd ~/.aws/credentials\nOutput: root:x:0:0:root:/root:/bin/bash\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","cache_control":{"type":"ephemeral"}}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic official CLI for Claude.","cache_control":{"type":"ephemeral"}}],"tools":[],"metadata":{"user_id":"user_cac3250bfea25c22f4deeaa4f2203cfb2d32fa6d33fc2be55da7585999de0387_account__session_6410ddbe-4a76-4d6a-87b4-a2e5e2d3b853"},"max_tokens":16384,"temperature":1,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":2536,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_start","message":{"model":"claude-haiku-4-5-20251001","id":"msg_bdrk_01Hxoz2bLhqvhZHSkdphvtZp","type":"message","role":"assistant","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2536,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":2}}},{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":2536,"outputTokenCount":31,"invocationLatency":1200,"firstByteLatency":900}}],"outputTokenCount":31},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/vg@foo.com"},"inferenceRegion":"us-east-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}' output_fields: - user diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 4b353862ea..a0a2532611 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 182d512dca..d4c45e3cb9 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 5031b5cd33..964ffd4bf8 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index f0c01197f6..d5efa8b2be 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index c5e2c3a4e5..d15f4e6109 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 7b4411afbd..eb4f327ebe 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 1461a8eaa6..6bb5aac90c 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 177b30e212..f863f7d359 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index b7fd87116e..26056aaaf7 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 22983a3d9f..a31f829e9c 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 65cb093d4f..9e8af8668d 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 8c5adbf8ae..16df973510 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index da60f90a28..2db4d47a9c 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 9a0c666f20..1689413757 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index d6888c0dee..831876c413 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index b0ae6b37c9..cbf230589f 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 7a086791e4..b98d46e5e2 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index f0ca04a229..56e530b66f 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index ce39762a76..aaba9d6bf0 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index fb083554f3..fdb84eb9cb 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 1c61b96dac..8098881c4d 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index c1d309bda9..17812205b6 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 5b89633bdb..6f196a610a 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - column - action diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index aa3e7c95cb..f6d66b2b29 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -11,5 +11,5 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index 04a92090d7..bf1e8a39ca 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - Cisco_ASA_action - Cisco_ASA_message_id diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index 3bea5f94aa..36c79c9f75 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - access_device.browser - access_device.browser_version diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index b3fa5fb6d7..27c88ee60e 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - action - actionlabel diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index 025771a5a9..bf6b6c5e82 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Networks Add-on url: https://splunkbase.splunk.com/app/1467 - version: 2.7.9 + version: 2.8.2 fields: - _time - aci_message_text diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index d0c47aadec..38e7825a81 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - _time - app diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index 5c86c068fd..eed09ca0be 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - _time - cluster_name diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 8487727aad..637361a36c 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - _time - app diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index bdf4c50c56..f7cacd0c61 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -5,115 +5,115 @@ creation_date: '2026-05-06' modification_date: '2026-05-06' author: Bhavin Patel, Splunk description: | - Captures DNS security events from Cisco Secure Access (including Umbrella-style DNS policy and roaming client telemetry) with client identity, query and response metadata, resolved domain, and URL/content categorization. - This data source supports detections that correlate user or host activity with high-risk categories such as proxy and anonymizer infrastructure. + Captures DNS security events from Cisco Secure Access (including Umbrella-style DNS policy and roaming client telemetry) with client identity, query and response metadata, resolved domain, and URL/content categorization. + This data source supports detections that correlate user or host activity with high-risk categories such as proxy and anonymizer infrastructure. source: not_applicable sourcetype: cisco:cloud_security:dns supported_TA: - - name: Cisco Secure Access Add-on for Splunk - url: https://splunkbase.splunk.com/app/7569 - version: 1.0.50 + - name: Cisco Secure Access Add-on for Splunk + url: https://splunkbase.splunk.com/app/7569 + version: 1.0.52 fields: -- RecordType -- ReplyCode -- Timestamp -- _time -- action -- app -- blocked_category -- category -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- destination_countries -- domain -- eventtype -- granular_identity_type -- host -- identities -- identity_type -- index -- linecount -- message_type -- organization_id -- product -- punct -- query -- query_type -- record_type -- reply_code -- reply_code_id -- rule -- rule_id -- s3_uri -- source -- sourcetype -- splunk_server -- splunk_server_group -- src -- src_asset -- src_asset_id -- src_asset_tag -- src_bunit -- src_category -- src_city -- src_country -- src_dns -- src_external_ip -- src_ip -- src_is_expected -- src_lat -- src_long -- src_mac -- src_nt_host -- src_owner -- src_pci_domain -- src_priority -- src_requires_av -- src_should_timesync -- src_should_update -- src_translated_ip -- tag -- tag::action -- tag::app -- tag::eventtype -- tag::user_category -- tag::user_identity_tag -- tag::user_watchlist -- timeendpos -- timestartpos -- user -- user_bunit -- user_category -- user_email -- user_endDate -- user_first -- user_identity -- user_identity_id -- user_identity_tag -- user_last -- user_managedBy -- user_nick -- user_phone -- user_prefix -- user_priority -- user_startDate -- user_suffix -- user_watchlist -- user_work_city -- user_work_country -- user_work_lat -- user_work_long -- vendor -- vendor_product + - RecordType + - ReplyCode + - Timestamp + - _time + - action + - app + - blocked_category + - category + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - destination_countries + - domain + - eventtype + - granular_identity_type + - host + - identities + - identity_type + - index + - linecount + - message_type + - organization_id + - product + - punct + - query + - query_type + - record_type + - reply_code + - reply_code_id + - rule + - rule_id + - s3_uri + - source + - sourcetype + - splunk_server + - splunk_server_group + - src + - src_asset + - src_asset_id + - src_asset_tag + - src_bunit + - src_category + - src_city + - src_country + - src_dns + - src_external_ip + - src_ip + - src_is_expected + - src_lat + - src_long + - src_mac + - src_nt_host + - src_owner + - src_pci_domain + - src_priority + - src_requires_av + - src_should_timesync + - src_should_update + - src_translated_ip + - tag + - tag::action + - tag::app + - tag::eventtype + - tag::user_category + - tag::user_identity_tag + - tag::user_watchlist + - timeendpos + - timestartpos + - user + - user_bunit + - user_category + - user_email + - user_endDate + - user_first + - user_identity + - user_identity_id + - user_identity_tag + - user_last + - user_managedBy + - user_nick + - user_phone + - user_prefix + - user_priority + - user_startDate + - user_suffix + - user_watchlist + - user_work_city + - user_work_country + - user_work_lat + - user_work_long + - vendor + - vendor_product output_fields: - - category - - domain - - src_ip - - user + - category + - domain + - src_ip + - user example_log: '"2026-04-20 22:23:29","EC2AMAZ-J8G2CH1","EC2AMAZ-J8G2CH1","10.0.1.115","3.151.127.146","Allowed","1 (A)","NOERROR","www.proxysite.com.","Proxy/Anonymizer,Application,Filter Avoidance","Anyconnect Roaming Client","Anyconnect Roaming Client","","139213","","8209150"' diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index 5b1c49627c..ca67175f6f 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -10,7 +10,7 @@ sourcetype: cisco:cloud_security:firewall supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.50 + version: 1.0.52 fields: - _time - action diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index 3b981bad63..eb63224d00 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -5,185 +5,185 @@ creation_date: '2026-05-08' modification_date: '2026-05-08' author: Bhavin Patel, Splunk description: | - Captures HTTP/HTTPS proxy access events from Cisco Secure Access, including requesting source, user identity, URL, HTTP method, response status, and user-agent metadata. - This data source supports detection of automated web reconnaissance, suspicious browsing patterns, and policy-evasion behavior based on high-volume client errors and URL enumeration activity. + Captures HTTP/HTTPS proxy access events from Cisco Secure Access, including requesting source, user identity, URL, HTTP method, response status, and user-agent metadata. + This data source supports detection of automated web reconnaissance, suspicious browsing patterns, and policy-evasion behavior based on high-volume client errors and URL enumeration activity. source: cisco_cloud_security_addon sourcetype: cisco:cloud_security:proxy supported_TA: - - name: Cisco Secure Access Add-on for Splunk - url: https://splunkbase.splunk.com/app/7569 - version: 1.0.50 + - name: Cisco Secure Access Add-on for Splunk + url: https://splunkbase.splunk.com/app/7569 + version: 1.0.52 fields: -- _time -- action -- action_isolate -- amp_disposition -- amp_malwarename -- amp_score -- app -- application_ids -- av_detection -- blocked_category -- bytes -- bytes_in -- bytes_out -- category -- certificate_errors -- content_type -- data_center -- datamodel -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dest_asset -- dest_asset_id -- dest_asset_tag -- dest_bunit -- dest_category -- dest_city -- dest_country -- dest_dns -- dest_ip -- dest_is_expected -- dest_lat -- dest_long -- dest_mac -- dest_nt_host -- dest_owner -- dest_pci_domain -- dest_priority -- dest_requires_av -- dest_should_timesync -- dest_should_update -- destination_list_id -- detected_response_file_type -- disposition -- dlp_status -- egress -- eventtype -- file_action -- file_hash -- filename -- forward_method -- geo_location_of_blocked_destination_countries -- host -- hostname -- http_content_type -- http_method -- http_referrer -- http_user_agent -- http_user_agent_length -- identities -- identity_type -- index -- isolateAction -- linecount -- malwarename_name -- message_correlation_id -- msp_organization_id -- organization_id -- policy_identities -- policy_identity_type -- policy_type -- producer -- product -- pua -- punct -- request_method -- request_size -- response_size -- response_size_body -- rule_id -- rule_set_id -- s3_uri -- score -- security_overridden -- server_name -- sha256 -- source -- sourcetype -- splunk_server -- splunk_server_group -- src -- src_asset -- src_asset_id -- src_asset_tag -- src_bunit -- src_category -- src_city -- src_country -- src_dns -- src_ip -- src_is_expected -- src_lat -- src_long -- src_mac -- src_nt_host -- src_owner -- src_pci_domain -- src_priority -- src_requires_av -- src_should_timesync -- src_should_update -- src_translated_ip -- ssl_error -- ssl_subject_common_name -- status -- status_warning -- tag -- tag::action -- tag::app -- tag::dest_requires_av -- tag::dest_should_timesync -- tag::dest_should_update -- tag::eventtype -- tag::user_category -- tag::user_identity_tag -- tag::user_watchlist -- time_based_rule -- timeendpos -- timestartpos -- url -- url_domain -- url_length -- user -- user_bunit -- user_category -- user_email -- user_endDate -- user_first -- user_identity -- user_identity_id -- user_identity_tag -- user_last -- user_managedBy -- user_nick -- user_phone -- user_prefix -- user_priority -- user_startDate -- user_suffix -- user_type -- user_watchlist -- user_work_city -- user_work_country -- user_work_lat -- user_work_long -- vendor -- vendor_product -- warnStatus -- warn_categories + - _time + - action + - action_isolate + - amp_disposition + - amp_malwarename + - amp_score + - app + - application_ids + - av_detection + - blocked_category + - bytes + - bytes_in + - bytes_out + - category + - certificate_errors + - content_type + - data_center + - datamodel + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_asset + - dest_asset_id + - dest_asset_tag + - dest_bunit + - dest_category + - dest_city + - dest_country + - dest_dns + - dest_ip + - dest_is_expected + - dest_lat + - dest_long + - dest_mac + - dest_nt_host + - dest_owner + - dest_pci_domain + - dest_priority + - dest_requires_av + - dest_should_timesync + - dest_should_update + - destination_list_id + - detected_response_file_type + - disposition + - dlp_status + - egress + - eventtype + - file_action + - file_hash + - filename + - forward_method + - geo_location_of_blocked_destination_countries + - host + - hostname + - http_content_type + - http_method + - http_referrer + - http_user_agent + - http_user_agent_length + - identities + - identity_type + - index + - isolateAction + - linecount + - malwarename_name + - message_correlation_id + - msp_organization_id + - organization_id + - policy_identities + - policy_identity_type + - policy_type + - producer + - product + - pua + - punct + - request_method + - request_size + - response_size + - response_size_body + - rule_id + - rule_set_id + - s3_uri + - score + - security_overridden + - server_name + - sha256 + - source + - sourcetype + - splunk_server + - splunk_server_group + - src + - src_asset + - src_asset_id + - src_asset_tag + - src_bunit + - src_category + - src_city + - src_country + - src_dns + - src_ip + - src_is_expected + - src_lat + - src_long + - src_mac + - src_nt_host + - src_owner + - src_pci_domain + - src_priority + - src_requires_av + - src_should_timesync + - src_should_update + - src_translated_ip + - ssl_error + - ssl_subject_common_name + - status + - status_warning + - tag + - tag::action + - tag::app + - tag::dest_requires_av + - tag::dest_should_timesync + - tag::dest_should_update + - tag::eventtype + - tag::user_category + - tag::user_identity_tag + - tag::user_watchlist + - time_based_rule + - timeendpos + - timestartpos + - url + - url_domain + - url_length + - user + - user_bunit + - user_category + - user_email + - user_endDate + - user_first + - user_identity + - user_identity_id + - user_identity_tag + - user_last + - user_managedBy + - user_nick + - user_phone + - user_prefix + - user_priority + - user_startDate + - user_suffix + - user_type + - user_watchlist + - user_work_city + - user_work_country + - user_work_lat + - user_work_long + - vendor + - vendor_product + - warnStatus + - warn_categories output_fields: - - src_ip - - user - - status - - url - - http_user_agent + - src_ip + - user + - status + - url + - http_user_agent example_log: | - "2026-04-20 21:57:29","EC2AMAZ-J8G2CH1","10.0.1.115","3.151.127.146","104.20.23.154","text/html","ALLOWED","http://example.com/css-3444","","gobuster/3.8.1","404","","790","528","fb91d75a6bb430787a61b0aec5e374f580030f2878e1613eab5ca6310f7bbb9a","Research/Reference,Reference","","","","","","Anyconnect Roaming Client","","EC2AMAZ-J8G2CH1","Anyconnect Roaming Client","GET","ALLOWED","","css-3444","14303105","139213","","","","","","","","","","mps-7b95df5757-wmc2v.sigproxy.prod_aws_us-east-2_1_0n","PROD_AWS_US-EAST-2_1_0N","false","","false","false","","","8209150" + "2026-04-20 21:57:29","EC2AMAZ-J8G2CH1","10.0.1.115","3.151.127.146","104.20.23.154","text/html","ALLOWED","http://example.com/css-3444","","gobuster/3.8.1","404","","790","528","fb91d75a6bb430787a61b0aec5e374f580030f2878e1613eab5ca6310f7bbb9a","Research/Reference,Reference","","","","","","Anyconnect Roaming Client","","EC2AMAZ-J8G2CH1","Anyconnect Roaming Client","GET","ALLOWED","","css-3444","14303105","139213","","","","","","","","","","mps-7b95df5757-wmc2v.sigproxy.prod_aws_us-east-2_1_0n","PROD_AWS_US-EAST-2_1_0N","false","","false","false","","","8209150" diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index ed96cbbe2d..895f9fe20a 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - AC_RuleAction - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index fdfd338ddb..d623fdb85a 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - app - Application diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index 309b325466..4d9589c58e 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - Application - Classification diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 32b048111d..9132278b02 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -17,7 +17,7 @@ separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 2.0.5 + version: 3.1.1 fields: - action - description diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index 05c7e2f476..d2f90cb5cf 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -18,7 +18,7 @@ separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 2.0.5 + version: 3.1.1 fields: - AuthenticationId - AuthenticationId_meaning diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index a9b1f66987..2fe9a8b87d 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -16,7 +16,7 @@ sourcetype: gsuite:drive:json supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - email diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 5e9526e61b..a536a2cca4 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -15,7 +15,7 @@ sourcetype: gsuite:gmail:bigquery supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - action_type diff --git a/data_sources/github_enterprise_audit_logs.yml b/data_sources/github_enterprise_audit_logs.yml index 893b9b4e98..f980d37742 100644 --- a/data_sources/github_enterprise_audit_logs.yml +++ b/data_sources/github_enterprise_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: httpevent supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 3.2.0 + version: 3.3.1 fields: - _document_id - action diff --git a/data_sources/github_organizations_audit_logs.yml b/data_sources/github_organizations_audit_logs.yml index e6e106f4a1..cf90f2b8cf 100644 --- a/data_sources/github_organizations_audit_logs.yml +++ b/data_sources/github_organizations_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: github:cloud:audit supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 3.2.0 + version: 3.3.1 fields: - _document_id - action diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index acd5970dd5..e6085340b3 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -10,7 +10,7 @@ sourcetype: gws:reports:login supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - action - actor.callerType diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index ed05961581..ac3e4a7855 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -17,7 +17,7 @@ separator_value: login_failure supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - actor.email diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 4b61dd8b5f..353d1d40cf 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -17,7 +17,7 @@ separator_value: login_success supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - actor.email diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 164e9aefb7..cf1a8a10f0 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index afbe0ec701..bb4692329a 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index 9b83e49dc1..f82333876b 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index f7b4fcf4dd..bdca049e91 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 9f96075a6e..5b58a4785a 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index 1d5c039877..ed4e76f993 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 6f0953cec0..64f681c8dc 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 44e2a8935b..842bd99048 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 1db5103e14..02f1314857 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index b5d9647033..c385210b04 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 090a768534..c84136000d 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -4,53 +4,52 @@ version: 1 creation_date: '2025-05-06' modification_date: '2025-05-06' author: Ravent Tait, Splunk -description: Logs kernel events on a Linux system, including - service starts/stops, hardware events, authentication notices, and other OS-level activity. +description: Logs kernel events on a Linux system, including service starts/stops, hardware events, authentication notices, and other OS-level activity. mitre_components: -- Service Modification -- Service Metadata -- OS API Execution -- Application Log Content + - Service Modification + - Service Metadata + - OS API Execution + - Application Log Content source: /var/log/kern sourcetype: linux_messages_syslog supported_TA: -- name: Splunk Add-on for Unix and Linux - url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + - name: Splunk Add-on for Unix and Linux + url: https://splunkbase.splunk.com/app/833 + version: 10.3.1 fields: -- _time -- action -- app -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dvc -- eventtype -- host -- index -- linecount -- pid -- process -- punct -- source -- sourcetype -- splunk_server -- src -- src_port -- sshd_protocol -- tag -- tag::action -- tag::eventtype -- timeendpos -- timestartpos -- user -- user_name -- vendor_action -- vendor_product + - _time + - action + - app + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - eventtype + - host + - index + - linecount + - pid + - process + - punct + - source + - sourcetype + - splunk_server + - src + - src_port + - sshd_protocol + - tag + - tag::action + - tag::eventtype + - timeendpos + - timestartpos + - user + - user_name + - vendor_action + - vendor_product example_log: 'May 6 17:24:00 ubuntu kernel: [ 801.664268] NET: Registered PF_ALG protocol family' diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index b8dd8ae5ba..56434973a9 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - _time - action diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 141ebdf0de..7b095e9329 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index da24c4688c..b6673df534 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index e4ec349eb5..12a1f1dc03 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/okta.yml b/data_sources/okta.yml index 01fc34cfdf..13546f1ac4 100644 --- a/data_sources/okta.yml +++ b/data_sources/okta.yml @@ -16,7 +16,7 @@ sourcetype: OktaIM2:log supported_TA: - name: Splunk Add-on for Okta Identity Cloud url: https://splunkbase.splunk.com/app/6553 - version: 5.0.2 + version: 5.0.3 output_fields: - dest - src diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index b83bd67d0b..7ed3330faa 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.1.0 + version: 3.2.1 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 00e9798ece..0f6d642ea8 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.1.0 + version: 3.2.1 fields: - _time - date_hour diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6a20ab8128..394ee4689e 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/sysmon_eventid_1.yml b/data_sources/sysmon_eventid_1.yml index f0a8effbdf..0c6c58dfb1 100644 --- a/data_sources/sysmon_eventid_1.yml +++ b/data_sources/sysmon_eventid_1.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index d54f84444d..d1ba331c5b 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - CallTrace diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index 47c82f9ac8..847bf94914 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index bfc98a539c..b52aefa9f7 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index 9e4f2384db..9dd9afc34d 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_14.yml b/data_sources/sysmon_eventid_14.yml index 4a0eea5ee2..877834a5fd 100644 --- a/data_sources/sysmon_eventid_14.yml +++ b/data_sources/sysmon_eventid_14.yml @@ -12,7 +12,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time example_log: '' diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index bcae8778e0..45aa929ea7 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index b149c566ed..53031fbf53 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -15,7 +15,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index 09741457b3..01dec72da3 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_20.yml b/data_sources/sysmon_eventid_20.yml index a92ac49516..2e0e8db5f8 100644 --- a/data_sources/sysmon_eventid_20.yml +++ b/data_sources/sysmon_eventid_20.yml @@ -17,7 +17,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_21.yml b/data_sources/sysmon_eventid_21.yml index c1add4adfd..a17d1dea05 100644 --- a/data_sources/sysmon_eventid_21.yml +++ b/data_sources/sysmon_eventid_21.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index e267c09d70..fdaa49c146 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index d9436f249c..6d934d8138 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Archived diff --git a/data_sources/sysmon_eventid_26.yml b/data_sources/sysmon_eventid_26.yml index ee3d6376a2..07fabf9724 100644 --- a/data_sources/sysmon_eventid_26.yml +++ b/data_sources/sysmon_eventid_26.yml @@ -12,7 +12,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time output_fields: diff --git a/data_sources/sysmon_eventid_29.yml b/data_sources/sysmon_eventid_29.yml index 75955a4689..4ab79dacf8 100644 --- a/data_sources/sysmon_eventid_29.yml +++ b/data_sources/sysmon_eventid_29.yml @@ -12,7 +12,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - action diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index 71d8619875..2b0e1cfab0 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_5.yml b/data_sources/sysmon_eventid_5.yml index d62d02fe1b..e4c67f2509 100644 --- a/data_sources/sysmon_eventid_5.yml +++ b/data_sources/sysmon_eventid_5.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index 2aa7542d3a..bb5efed138 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index 00a6d580c0..b4ec9a8fd3 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index ef49b5b310..53a5c3c09b 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_9.yml b/data_sources/sysmon_eventid_9.yml index 6f6ee986d5..134244241d 100644 --- a/data_sources/sysmon_eventid_9.yml +++ b/data_sources/sysmon_eventid_9.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 7e1ec4fde7..10f397dfe8 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 4ef6ecee00..1134642e1e 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index fb960b1d42..c819d61225 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 9107707eaf..0dc7ec7343 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index a98f34690b..25989597c4 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index b45b9b50fa..8b97db5796 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 869197ab81..954960673c 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 792a15ebbc..e1fed6202a 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 22e3b71725..fd04a03871 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 00920b4b37..e015fea468 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 2701795166..cea7a04b89 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index f4e7771023..d190dd24f6 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 14d92e22a7..44dbde3791 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 011347afb2..cf58df9f88 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 9c97a01efe..24794c9317 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 77928d8273..e24a33ffc0 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event> diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index b0b5c2cef0..50358cbb4a 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 8d9767ba9c..4d880bdfc9 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 7b59c9cd6b..7ce4f4f10b 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 1a813f46f9..d9c500e81b 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 88cb4531d3..052c42d354 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 3b54c95906..7ca20f0675 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 882e7a7bd0..0d27f6ebcd 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 257bd4a5d4..6d6662b271 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 529620eb60..492b6118b0 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index d952de1f7e..eaa8668f29 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 6bd7d957fc..dbff470f19 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 3dbf23664f..95c41e545d 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 8586c6984d..90fec45a0a 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 3971f62bfc..a19e174445 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 28e5d9fead..094b017f2f 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index e8c1fb0efb..92817c9c7d 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 6b8fa7d829..aef95a0736 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index c0dc0121e4..2aee0b516c 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index f74d26c94a..a4b77b42f4 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 280d7f8262..d75420c82a 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 642687b596..d968667265 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 3b4b6a9c06..a36980f988 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index a80ed23a9b..590d5e1f8c 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 4dc60cd9bd..fdb23972cb 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 7184ff77e3..9824e45fd8 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 5c1d729155..8efa4d630a 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 06b3adb988..19c9db852d 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 31484a3587..049f915001 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 5105961915..4778011edf 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -6,7 +6,7 @@ modification_date: '2026-06-15' author: Raven Tait, Splunk description: Logs an event when an attempt is made to change an account's password, whether successful or not. mitre_components: -- User Account Modification + - User Account Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog separator: EventCode @@ -14,103 +14,92 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: -- _time -- Caller_Domain -- Caller_User_Name -- CategoryString -- Channel -- Computer -- Error_Code -- EventCode -- EventData_Xml -- EventID -- EventRecordID -- Guid -- Keywords -- Level -- Logon_ID -- Name -- Opcode -- ProcessID -- RecordNumber -- SubjectDomainName -- SubjectLogonId -- SubjectUserName -- SubjectUserSid -- SystemTime -- System_Props_Xml -- TargetDomainName -- TargetSid -- TargetUserName -- Target_Domain -- Target_User_Name -- Task -- ThreadID -- Version -- action -- app -- change_type -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dest_nt_domain -- dvc -- dvc_nt_host -- event_id -- eventtype -- host -- id -- index -- linecount -- name -- object -- object_attrs -- object_category -- object_id -- product -- punct -- result -- session_id -- signature -- signature_id -- source -- sourcetype -- splunk_server -- src_nt_domain -- src_user -- src_user_name -- status -- subject -- ta_windows_action -- ta_windows_security_CategoryString -- tag -- tag::eventtype -- timeendpos -- timestartpos -- user -- user_group -- user_name -- vendor -- vendor_product + - _time + - Caller_Domain + - Caller_User_Name + - CategoryString + - Channel + - Computer + - Error_Code + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - Guid + - Keywords + - Level + - Logon_ID + - Name + - Opcode + - ProcessID + - RecordNumber + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - SystemTime + - System_Props_Xml + - TargetDomainName + - TargetSid + - TargetUserName + - Target_Domain + - Target_User_Name + - Task + - ThreadID + - Version + - action + - app + - change_type + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - event_id + - eventtype + - host + - id + - index + - linecount + - name + - object + - object_attrs + - object_category + - object_id + - product + - punct + - result + - session_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_user + - src_user_name + - status + - subject + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - timeendpos + - timestartpos + - user + - user_group + - user_name + - vendor + - vendor_product output_fields: -- dest -example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider - Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-A5BA-3E3B0328C30D"></Provider> - <EventID>4723</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode> - <Keywords>0x8010000000000000</Keywords><TimeCreated SystemTime="2026-04-21T17:43:18.298641Z"> - </TimeCreated><EventRecordID>781490</EventRecordID><Correlation ActivityID="9F3364FE-E417-0002-2065-339F17E4DA01"> - </Correlation><Execution ProcessID="724" ThreadID="12596"></Execution><Channel>Security</Channel> - <Computer>WIN10-21H1.strt.labs</Computer><Security></Security></System><EventData> - <Data Name="TargetUserName">Administrator</Data><Data Name="TargetDomainName">WIN10-21H1</Data> - <Data Name="TargetSid">S-1-5-21-1538153195-943065003-848949206-500</Data><Data Name="SubjectUserSid"> - S-1-5-21-1538153195-943065003-848949206-1003</Data><Data Name="SubjectUserName">bob</Data> - <Data Name="SubjectDomainName">WIN10-21H1</Data><Data Name="SubjectLogonId">0x61a292</Data> - <Data Name="PrivilegeList">-</Data></EventData></Event> + - dest +example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-A5BA-3E3B0328C30D"></Provider> <EventID>4723</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode> <Keywords>0x8010000000000000</Keywords><TimeCreated SystemTime="2026-04-21T17:43:18.298641Z"> </TimeCreated><EventRecordID>781490</EventRecordID><Correlation ActivityID="9F3364FE-E417-0002-2065-339F17E4DA01"> </Correlation><Execution ProcessID="724" ThreadID="12596"></Execution><Channel>Security</Channel> <Computer>WIN10-21H1.strt.labs</Computer><Security></Security></System><EventData> <Data Name="TargetUserName">Administrator</Data><Data Name="TargetDomainName">WIN10-21H1</Data> <Data Name="TargetSid">S-1-5-21-1538153195-943065003-848949206-500</Data><Data Name="SubjectUserSid"> S-1-5-21-1538153195-943065003-848949206-1003</Data><Data Name="SubjectUserName">bob</Data> <Data Name="SubjectDomainName">WIN10-21H1</Data><Data Name="SubjectLogonId">0x61a292</Data> <Data Name="PrivilegeList">-</Data></EventData></Event> diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 0b06b7823a..2e1ab15fd5 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index ca05c7b840..4b4a6cb80c 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 6ddc2aba57..bffa3f61d6 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 0aa2c2f0b7..087aff4eea 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index bcba79a79d..0e6346d3b2 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 9487a6ac52..06c4b66e66 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 30f8bc23e8..87ad0bceae 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index d95f852eb8..5c7de0fd65 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index f128bbfcc4..4c27227db2 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index fb6f1f3ca8..9db856f358 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index b0f6314703..d055166b55 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 7b643fb3d0..eb0238ac90 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index eb26156fe9..513872af7e 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 216eb54d2c..eca1bb9609 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 8b61381ede..37cd80c800 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 4dbe460a36..48f80c0979 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index c53348491f..8f7b0b077e 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 9db0814db3..d8110c1a28 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 0d954d3b5c..d11908d257 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 2b1506eda9..61f7a15c8e 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 16751ea4ef..41d424b7e8 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 408aaa466b..fd970cd422 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index ed8f3691a8..7e55eadbc3 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index 4b239b5056..b0f7b5fe5c 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 8a945e0fe8..301fcb7215 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 70bae43f05..222bc3fad3 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 8eebe0e5a9..feb4495106 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index bdd7735a81..ca4e0c7c95 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 9379641c7d..e33210fe21 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 2016e280f6..7646c112a2 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 2d9e806305..44ee333e11 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index b10ef8870b..2b0894834e 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 961be864ee..67478d0f08 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index b2035008e4..ab04793a83 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 253ce10397..5340ac3d62 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index f5f3cf1116..abf49c3db8 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 393098f288..2a40fdcf81 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 1647d2e832..dbdf8114b3 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index faea29ccad..6ccea0b238 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 49df88f658..47015e8dd1 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 642359a985..31d4f0ca60 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index dd3e3849ea..728e981ba5 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 0cf395b1d2..b14cad1c4c 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 518d67eacf..552b3d1027 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index a1fda46fe8..95bbb82590 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index e7fe0ff722..618165e9f7 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 01ff84004b..bd708a219d 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index a3412a3b42..6306f875ca 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 8c6977fd3a..85da612242 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName From f72a960e7db6fa5e8a43fd50793d230c41880ae2 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Tue, 21 Jul 2026 20:39:27 +0530 Subject: [PATCH 038/164] Update data source TA and install.yml app versions (#4174) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- data_sources/cisco_secure_access_dns.yml | 2 +- data_sources/cisco_secure_access_firewall.yml | 2 +- data_sources/cisco_secure_access_proxy.yml | 2 +- 65 files changed, 65 insertions(+), 65 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index c40126191c..f3328a8bbc 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index bd7fc59c23..a9511d9d9b 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index dbe9bbafd8..880aef37dd 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index d80e70b155..fd63339bb3 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index efe8b33ddb..4c3cbe5878 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 47f47f1900..e73a5fdbfe 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index afce3a4582..0369aac026 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 55fa3c5e41..b38bd36a87 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index a421c79763..d250e861ac 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 3f8eab8b67..63f6d6c21f 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index 1ad5447148..a18640b739 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index dfd4ba9321..b344919b5b 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index e2a3e40ce3..f9979ecf7d 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index 1a462fcf5d..b5512900a2 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 1dd734b3c2..e8d99ba572 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index bf04e2a317..ab7ff1026d 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index e08314d029..40ec3ef513 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 44405c5e8b..1ba2d214ef 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 3d53d8c6c7..703afa31c0 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index 67d95cdb65..362a3f413c 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index c4f6cc2598..81cf1dd57e 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 010c2162c1..ad3e9f7005 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 8b13e8bdc2..65395481c2 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 55c95ea4ad..043a0c779f 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 3809b00a30..12c0a6eb1b 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 7270838ad1..02b74f5048 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 614f3fd068..1c52a641a2 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 6562a321da..8eab3f8a75 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 84c522f2f4..fb938e6771 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 4929e2e883..7165cf16f2 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index b8105c4862..52e84b8efb 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index c234e022e6..6fbcecf73d 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index e52c960d46..bba6d81026 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index abcf17e438..950a8a1b2f 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index c88017ac48..874c871b8c 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index ee363cb8cd..627d0ff2de 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index d19da791f6..1d7fb02b10 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 2346b22494..b49e80f1f8 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 38d1565418..05e052adf0 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index c39f7ca141..0c206891b4 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 060a86c2dc..d2a7ae0fd7 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index 924c2c1367..2e646c9b8d 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index 83b42f8449..1eb10a3089 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 06a7cd7584..62d2f6d78b 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index a6b0eeca89..8b0a18eb83 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 272e734d13..56005c7534 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index afebb51c8f..8b217dd583 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 172b11719d..42c1c946e8 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index c24c6c2417..ea9ceda6cb 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index ac76f2f355..a10cdd3abb 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 9f834c10ce..43d50753ea 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index 22e5498275..e1ac9e542b 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 37d43a3286..3d3dbcab74 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 34e190129c..7053746645 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index c3264444c1..9f5f3d620d 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 7858189b11..3edf234121 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 9790a74d67..026fcfd469 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 2e58b10a33..38503edd37 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 755e03f508..c0a40b5370 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index cd980da894..a2d19c3b9a 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index eb0cdc7ecf..fba9a7abde 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.1.2 + version: 8.2.0 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index b2bda6430e..3d7464278d 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - AwsAccountId diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index f7cacd0c61..81ad956034 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:dns supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.52 + version: 1.0.53 fields: - RecordType - ReplyCode diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index ca67175f6f..d4cd0e777c 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -10,7 +10,7 @@ sourcetype: cisco:cloud_security:firewall supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.52 + version: 1.0.53 fields: - _time - action diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index eb63224d00..b49c8c2dfe 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:proxy supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.52 + version: 1.0.53 fields: - _time - action From 184982e33ff0306e66e5476e63e3c7cdfe082169 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 22 Jul 2026 14:15:30 +0530 Subject: [PATCH 039/164] Update data source TA and install.yml app versions (#4179) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- .../ms365_defender_incident_alerts.yml | 2 +- data_sources/ms_defender_atp_alerts.yml | 2 +- .../splunk_common_information_model_(cim).yml | 2 +- install.yml | 82 +++++++++---------- 4 files changed, 44 insertions(+), 44 deletions(-) diff --git a/data_sources/ms365_defender_incident_alerts.yml b/data_sources/ms365_defender_incident_alerts.yml index 7d33235198..5f623dfeac 100644 --- a/data_sources/ms365_defender_incident_alerts.yml +++ b/data_sources/ms365_defender_incident_alerts.yml @@ -16,7 +16,7 @@ sourcetype: ms365:defender:incident:alerts supported_TA: - name: Splunk Add-on for Microsoft Security url: https://splunkbase.splunk.com/app/6207 - version: 3.0.0 + version: 4.0.0 fields: - actorName - alertId diff --git a/data_sources/ms_defender_atp_alerts.yml b/data_sources/ms_defender_atp_alerts.yml index a38abee6a2..2baf4d980d 100644 --- a/data_sources/ms_defender_atp_alerts.yml +++ b/data_sources/ms_defender_atp_alerts.yml @@ -16,7 +16,7 @@ sourcetype: ms:defender:atp:alerts supported_TA: - name: Splunk Add-on for Microsoft Security url: https://splunkbase.splunk.com/app/6207 - version: 3.0.0 + version: 4.0.0 fields: - column - accountName diff --git a/data_sources/splunk_common_information_model_(cim).yml b/data_sources/splunk_common_information_model_(cim).yml index f9056852f2..b3be82871f 100644 --- a/data_sources/splunk_common_information_model_(cim).yml +++ b/data_sources/splunk_common_information_model_(cim).yml @@ -10,4 +10,4 @@ sourcetype: not_applicable supported_TA: - name: Splunk Common Information Model (CIM) url: https://splunkbase.splunk.com/app/1621 - version: 8.5.0 + version: 8.6.0 diff --git a/install.yml b/install.yml index 666032994e..2b299ead90 100644 --- a/install.yml +++ b/install.yml @@ -1,42 +1,42 @@ apps: - - appid: DA-ESS-ContentUpdate - hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz - - appid: SplunkEnterpriseSecuritySuite - url: https://splunkbase.splunk.com/app/263 - version: 8.5.1 - - appid: Splunk_TA_microsoft-iis - url: https://splunkbase.splunk.com/app/3185 - version: 2.0.0 - - appid: TA-suricata-4 - url: https://splunkbase.splunk.com/app/4242 - version: 2.3.4 - - appid: Splunk_TA_stream - url: https://splunkbase.splunk.com/app/5238 - version: 8.1.6 - - appid: Splunk_TA_stream_wire_data - url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 - - appid: TA-Zscaler_CIM - url: https://splunkbase.splunk.com/app/3865 - version: 4.1.5 - - appid: Splunk_TA_aws-kinesis-firehose - url: https://splunkbase.splunk.com/app/3719 - version: 1.3.2 - - appid: Splunk_TA_google-cloudplatform - url: https://splunkbase.splunk.com/app/3088 - version: 5.0.3 - - appid: utbox - url: https://splunkbase.splunk.com/app/2734 - version: 1.9.4 - - appid: SA-admon - url: https://splunkbase.splunk.com/app/6853 - version: 1.1.2 - - appid: TA-crowdstrike-falcon-event-streams - url: https://splunkbase.splunk.com/app/5082 - version: 3.7.2 - - appid: SA-VMWIndex - url: https://splunkbase.splunk.com/app/5640 - version: 4.0.4 - - appid: Splunk_SA_CIM - url: https://splunkbase.splunk.com/app/1621 - version: 8.5.0 + - appid: DA-ESS-ContentUpdate + hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz + - appid: SplunkEnterpriseSecuritySuite + url: https://splunkbase.splunk.com/app/263 + version: 8.5.1 + - appid: Splunk_TA_microsoft-iis + url: https://splunkbase.splunk.com/app/3185 + version: 2.0.0 + - appid: TA-suricata-4 + url: https://splunkbase.splunk.com/app/4242 + version: 2.3.4 + - appid: Splunk_TA_stream + url: https://splunkbase.splunk.com/app/5238 + version: 8.1.6 + - appid: Splunk_TA_stream_wire_data + url: https://splunkbase.splunk.com/app/5234 + version: 8.1.6 + - appid: TA-Zscaler_CIM + url: https://splunkbase.splunk.com/app/3865 + version: 4.1.5 + - appid: Splunk_TA_aws-kinesis-firehose + url: https://splunkbase.splunk.com/app/3719 + version: 1.3.2 + - appid: Splunk_TA_google-cloudplatform + url: https://splunkbase.splunk.com/app/3088 + version: 5.0.3 + - appid: utbox + url: https://splunkbase.splunk.com/app/2734 + version: 1.9.4 + - appid: SA-admon + url: https://splunkbase.splunk.com/app/6853 + version: 1.1.2 + - appid: TA-crowdstrike-falcon-event-streams + url: https://splunkbase.splunk.com/app/5082 + version: 3.7.2 + - appid: SA-VMWIndex + url: https://splunkbase.splunk.com/app/5640 + version: 4.0.4 + - appid: Splunk_SA_CIM + url: https://splunkbase.splunk.com/app/1621 + version: 8.6.0 From cf465dbe50c1756ab5a4dd75d330f18a9245268a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 08:47:05 +0000 Subject: [PATCH 040/164] Bump actions/labeler from 6 to 7 (#4177) Bumps [actions/labeler](https://github.com/actions/labeler) from 6 to 7. - [Release notes](https://github.com/actions/labeler/releases) - [Commits](https://github.com/actions/labeler/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/labeler dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .github/workflows/labeler.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 3dce58e0d5..32893e4b61 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@v7 with: repository: "splunk/security_content" - - uses: actions/labeler@v6 + - uses: actions/labeler@v7 with: sync-labels: true configuration-path: '.github/labeler.yml' \ No newline at end of file From 5847467ad43afe12bc083bb95352cfaafe04d1eb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 08:49:37 +0000 Subject: [PATCH 041/164] Bump actions/setup-go from 6 to 7 (#4176) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .github/workflows/yaml-validation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/yaml-validation.yml b/.github/workflows/yaml-validation.yml index 3ddfdf9435..fe4aa381c5 100644 --- a/.github/workflows/yaml-validation.yml +++ b/.github/workflows/yaml-validation.yml @@ -33,7 +33,7 @@ jobs: run: pip install yamllint - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@v7 - name: Install yamlfmt run: | From eb6f366201cb409a7aa15014303e4979d211b47e Mon Sep 17 00:00:00 2001 From: Cole Munz <145523609+munzzyy@users.noreply.github.com> Date: Wed, 22 Jul 2026 04:06:22 -0500 Subject: [PATCH 042/164] Fix `Windows Large Number of Computer Service Tickets Requested` (#4147) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- ..._of_computer_service_tickets_requested.yml | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index bbed89c02d..a8fed6397c 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -1,21 +1,28 @@ name: Windows Large Number of Computer Service Tickets Requested id: 386ad394-c9a7-4b4f-b66f-586252de20f0 -version: 11 +version: 12 creation_date: '2023-03-21' -modification_date: '2026-05-13' +modification_date: '2026-07-05' author: Mauricio Velazco, Splunk status: production type: Anomaly -description: The following analytic detects a high volume of Kerberos service ticket requests, specifically more than 30, from a single source within a 5-minute window. It leverages Event ID 4769, which logs when a Kerberos service ticket is requested, focusing on requests with computer names as the Service Name. This behavior is significant as it may indicate malicious activities such as lateral movement, malware staging, or reconnaissance. If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, potentially compromising the entire network. +description: |- + The following analytic detects a high volume of Kerberos service ticket requests, specifically more than 30, from a single source within a 5-minute window. + It leverages Event ID 4769, which logs when a Kerberos service ticket is requested, focusing on requests with computer names as the Service Name. This behavior is significant as it may indicate malicious activities such as lateral movement, malware staging, or reconnaissance. + If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, potentially compromising the entire network. data_source: - Windows Event Log Security 4769 search: |- `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$" - | bucket span=5m _time - | stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets values(dest) as dest - BY _time, IpAddress, TargetUserName - | where unique_targets > 30 - | `windows_large_number_of_computer_service_tickets_requested_filter` + | eval TargetUserName = mvindex(split(TargetUserName, "@"), 0) + | search NOT TargetUserName="*$" + | bucket span=5m _time + | stats dc(ServiceName) AS unique_targets + values(ServiceName) as host_targets + values(dest) as dest + by _time, IpAddress, TargetUserName + | where unique_targets > 30 + | `windows_large_number_of_computer_service_tickets_requested_filter` how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. known_false_positives: An single endpoint requesting a large number of kerberos service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems. references: From 40cf30bcbc8981f6a98d36c50705fb1ad954404a Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:59:12 +0200 Subject: [PATCH 043/164] Tag Analytics with Starland RAT Story (#4172) --------- Co-authored-by: Teoderick Contreras <tcontreras@splunk.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .../detect_mshta_url_in_command_line.yml | 5 +-- ...omain_controller_discovery_with_nltest.yml | 5 +-- ..._or_script_creation_in_suspicious_path.yml | 5 +-- ...hell_process___execution_policy_bypass.yml | 5 +-- .../endpoint/powershell_4104_hunting.yml | 5 +-- .../recon_avproduct_through_pwh_or_wmi.yml | 5 +-- .../registry_keys_used_for_persistence.yml | 5 +-- ...ution_policy_to_unrestricted_or_bypass.yml | 5 +-- ..._autostart_execution_in_startup_folder.yml | 5 +-- ...ndows_curl_download_to_suspicious_path.yml | 5 +-- .../windows_mshta_execution_in_registry.yml | 5 +-- .../windows_powershell_scheduletask.yml | 5 +-- .../windows_suspicious_process_file_path.yml | 5 +-- ...pt_or_cscript_suspicious_child_process.yml | 5 +-- ..._dns_query_request_by_telegram_bot_api.yml | 5 +-- ...ork_info_through_ip_check_web_services.yml | 5 +-- stories/starland_rat_campaign.yml | 34 +++++++++++++++++++ 17 files changed, 82 insertions(+), 32 deletions(-) create mode 100644 stories/starland_rat_campaign.yml diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 7c6cbdb918..f497bd613a 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -1,8 +1,8 @@ name: Detect MSHTA Url in Command Line id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 -version: 20 +version: 21 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Michael Haag, Splunk status: production type: TTP @@ -71,6 +71,7 @@ analytic_story: - XWorm - Cisco Network Visibility Module Analytics - NetSupport RMM Tool Abuse + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1218.005 diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index 01306e275d..5e561e1f26 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -1,8 +1,8 @@ name: Domain Controller Discovery with Nltest id: 41243735-89a7-4c83-bcdd-570aa78f00a1 -version: 13 +version: 14 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Mauricio Velazco, Splunk status: production type: TTP @@ -57,6 +57,7 @@ analytic_story: - BlackSuit Ransomware - Rhysida Ransomware - NetSupport RMM Tool Abuse + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1018 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index c14be99c02..e3e6d3cee1 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 29 +version: 30 creation_date: '2021-05-07' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -139,6 +139,7 @@ analytic_story: - Axios Supply Chain Post Compromise - VIP Keylogger - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index fe19745236..2e86d5d3ab 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,8 +1,8 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: 20 +version: 21 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Rico Valdez, Mauricio Velazco, Splunk status: production type: Anomaly @@ -59,6 +59,7 @@ analytic_story: - APT37 Rustonotto and FadeStealer - BlankGrabber Stealer - MuddyWater + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 8428f645ad..d8fb84f944 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,8 +1,8 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 27 +version: 28 creation_date: '2021-08-19' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Michael Haag, Splunk status: production type: Hunting @@ -86,6 +86,7 @@ analytic_story: - Axios Supply Chain Post Compromise - Salat Stealer - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index f6900a54eb..ca0a2fe969 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -1,8 +1,8 @@ name: Recon AVProduct Through Pwh or WMI id: 28077620-c9f6-11eb-8785-acde48001122 -version: 15 +version: 16 creation_date: '2021-06-14' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP @@ -62,6 +62,7 @@ analytic_story: - MoonPeak - Qakbot - Windows Post-Exploitation + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1592 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index af50fd3916..a01367e425 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,8 +1,8 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 34 +version: 35 creation_date: '2020-04-29' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -83,6 +83,7 @@ analytic_story: - Axios Supply Chain Post Compromise - Salat Stealer - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 7e197e0a76..41fe0969e9 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,8 +1,8 @@ name: Set Default PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d -version: 22 +version: 23 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Steven Dick, Patrick Bareiss, Splunk status: production type: TTP @@ -40,6 +40,7 @@ analytic_story: - Data Destruction - DarkGate Malware - SystemBC + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 6b3f2e9d5f..48b6050197 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -1,8 +1,8 @@ name: Windows Boot or Logon Autostart Execution In Startup Folder id: 99d157cb-923f-4a00-aee9-1f385412146f -version: 16 +version: 17 creation_date: '2023-01-16' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -50,6 +50,7 @@ analytic_story: - PromptFlux - BlankGrabber Stealer - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 1c539a33de..1a9ee0ad8d 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,8 +1,8 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: 21 +version: 22 creation_date: '2021-10-19' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -103,6 +103,7 @@ analytic_story: - Ingress Tool Transfer - NPM Supply Chain Compromise - Salt Typhoon + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml index 8ccfe64198..02e4c1ad72 100644 --- a/detections/endpoint/windows_mshta_execution_in_registry.yml +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -1,8 +1,8 @@ name: Windows Mshta Execution In Registry id: e13ceade-b673-4d34-adc4-4d9c01729753 -version: 12 +version: 13 creation_date: '2022-10-14' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP @@ -52,6 +52,7 @@ intermediate_findings: analytic_story: - Suspicious Windows Registry Activities - Windows Persistence Techniques + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1218.005 diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index edd80ba30d..dc161addef 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -1,8 +1,8 @@ name: Windows PowerShell ScheduleTask id: ddf82fcb-e9ee-40e3-8712-a50b5bf323fc -version: 13 +version: 14 creation_date: '2023-06-12' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Michael Haag, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ intermediate_findings: analytic_story: - Scheduled Tasks - Scattered Spider + - Starland RAT Campaign asset_type: Endpoint atomic_guid: - af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 76832167a1..48ec64c62e 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 26 +version: 27 creation_date: '2021-05-07' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP @@ -96,6 +96,7 @@ analytic_story: - VIP Keylogger - RoguePlanet - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 760f524d5f..f9153f7e79 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -1,8 +1,8 @@ name: Wscript Or Cscript Suspicious Child Process id: 1f35e1da-267b-11ec-90a9-acde48001122 -version: 16 +version: 17 creation_date: '2021-10-06' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ analytic_story: - MuddyWater - Axios Supply Chain Post Compromise - VIP Keylogger + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1055 diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml index e4a251deab..dc87224238 100644 --- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml +++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml @@ -1,8 +1,8 @@ name: Windows DNS Query Request by Telegram Bot API id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e -version: 11 +version: 12 creation_date: '2021-08-03' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -46,6 +46,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1071.004 diff --git a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml index c950356414..620ecb56d8 100644 --- a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -1,8 +1,8 @@ name: Windows Gather Victim Network Info Through Ip Check Web Services id: 70f7c952-0758-46d6-9148-d8969c4481d1 -version: 21 +version: 22 creation_date: '2022-06-24' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,6 +58,7 @@ analytic_story: - Void Manticore - BlankGrabber Stealer - VIP Keylogger + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1590.005 diff --git a/stories/starland_rat_campaign.yml b/stories/starland_rat_campaign.yml new file mode 100644 index 0000000000..3331d8a6fb --- /dev/null +++ b/stories/starland_rat_campaign.yml @@ -0,0 +1,34 @@ +name: Starland RAT Campaign +id: 77049a4c-74f0-4ab3-bcb9-9995ad6c0c0f +version: 1 +creation_date: '2026-07-20' +modification_date: '2026-07-20' +author: Teoderick Contreras, Splunk +status: production +description: |- + UAT-11795 is a Russian-speaking, financially motivated threat actor active since at least June 2025 that deploys a novel Python-based remote access trojan named Starland RAT alongside a bespoke PowerShell C2 memory implant called WLDR Agent. + The campaign uses ClickFix social engineering and trojanized software installers mimicking popular tools such as MobaXterm, WebEx, Zoom, and DBeaverCommunity to deliver a multi-stage infection chain. + Starland RAT provides persistent remote access, cryptocurrency wallet enumeration, screenshot capture, and shellcode injection capabilities, while the WLDR Agent provides an encrypted, memory-resident beaconing capability with multi-threaded PowerShell execution. + The actor further supports operations with CastleStealer, a .NET infostealer targeting credentials and crypto wallets, and Remcos RAT as supplemental tooling. + C2 resilience is achieved through a blockchain-anchored fallback mechanism using a Polygon smart contract to store XOR-encrypted backup domains, and Telegram bots for victim notification. +narrative: |- + The infection chain begins when a victim is directed via ClickFix lures to execute a command that downloads and launches a weaponized HTA file through mshta.exe. + The HTA file establishes an initial foothold by writing a Registry Run key for persistence and then fetches a trojanized NSIS installer from an actor-controlled staging domain. + The installer drops a Python loader disguised as a LICENSE.txt file, which XOR-decrypts (key 0xC6) and reflectively executes Starland RAT entirely in memory to minimize on-disk artifacts. + At startup, Starland RAT performs sandbox evasion by comparing system usernames and hostnames against known analysis environments such as WDAGUtilityAccount, Cuckoo, Any.Run, and Joe Sandbox, and verifies the presence of Zone.Identifier alternate data stream markers. + It then collects extensive host reconnaissance including hardware ID derived from the C drive volume serial number, RAM capacity, installed antivirus products, Active Directory membership and domain privilege status, cryptocurrency wallet presence across more than 40 wallet types, and a Base64-encoded screenshot. + This telemetry is transmitted via HTTP POST with XOR and Base64 encoding to primary C2 domains, with polling every 50 to 60 seconds. Should primary infrastructure become unavailable, the implant queries a Polygon smart contract to retrieve XOR-encrypted fallback C2 domains at runtime. + Persistence is established through a randomized scheduled task named PythonLauncher followed by three characters with an AtLogOn trigger, a startup folder LNK shortcut, and the Registry Run key set during initial HTA execution. + At the operator discretion, Starland RAT deploys the WLDR Agent by executing an embedded PowerShell script that beacons to a separate set of staging domains over HTTPS using AES-256-CBC encryption with HMAC-SHA256 authentication and PBKDF2-SHA256 key derivation. + WLDR runs a PowerShell RunspacePool of up to ten concurrent threads, enabling parallelized command execution with real-time output streaming and a mutex guard to prevent duplicate instances. + Telegram bots are used to notify operators of new victim check-ins. + The campaign primarily targets users in the United States and Europe through opportunistic, volume-driven distribution across developer tooling, IT administration, enterprise collaboration, and consumer gaming software categories, with the financial objective of credential and cryptocurrency asset theft. +references: + - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/ +category: + - Malware +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection From 855dea38ebe74f05186e4c2241b319cf29f7cdd9 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Fri, 24 Jul 2026 11:26:41 -0400 Subject: [PATCH 044/164] CVE 2026 46331 (#4153) * Detections for CVE-2026-46331 linux priv esc * Fix pedit offset * Fix macro filter name * Add host to dest rename * Fix description that went missing * Fix sourcetype * Update detection searches * Updates to search * Add linux_syslog macro --------- Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .../linux_apparmor_bypass_via_aaexec.yml | 71 +++++++++++++++++ ..._auditd_possible_setuid_execve_privesc.yml | 79 +++++++++++++++++++ ...binary_launched_process_with_null_argv.yml | 6 +- .../linux_pedit_offset_out_of_bounds.yml | 58 ++++++++++++++ ...lg_registration_outside_of_boot_window.yml | 6 +- macros/linux_syslog.yml | 8 ++ 6 files changed, 222 insertions(+), 6 deletions(-) create mode 100644 detections/endpoint/linux_apparmor_bypass_via_aaexec.yml create mode 100644 detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml create mode 100644 detections/endpoint/linux_pedit_offset_out_of_bounds.yml create mode 100644 macros/linux_syslog.yml diff --git a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml new file mode 100644 index 0000000000..21c54d3be5 --- /dev/null +++ b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml @@ -0,0 +1,71 @@ +name: Linux Apparmor Bypass Via Aaexec +id: b6d2a2b8-ad52-4a12-8956-dbf10012d1b8 +version: 1 +creation_date: '2026-06-30' +modification_date: '2026-06-30' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects aa-exec being used to launch a binary under the trinity, chrome, or flatpak AppArmor profiles where the executed target is not the legitimate application those profiles are intended to confine. This behavior is consistent with abuse of userns,-carrying AppArmor profiles to bypass Ubuntu's unprivileged user namespace restrictions as seen in the CVE-2026-46331 privilege escalation exploit. The analytic flags execution when the target command following -- is invoked via a relative path, resolves outside standard trusted install directories for these applications, or shares the same binary name as the calling parent process. Adversaries and red teams may abuse this technique to escalate privileges by tricking aa-exec into granting a namespace-creation capability to an arbitrary binary rather than the trusted application the profile was written for. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where + Processes.process_name="*aa-exec" + AND Processes.process="* -p *" + AND Processes.process="*--*" + AND Processes.process IN ("*trinity*","*chrome*","*flatpak*") + AND NOT Processes.process_name IN ("/user*","/opt*","/snap*","/var/lib/flatpak*") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_apparmor_bypass_via_aaexec_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Chrome, Flatpak, and the trinity profile are never legitimately re-executed with extraneious arguments from a non-browser binary path +references: + - https://github.com/sgkdev/packet_edit_meme + - https://tuxcare.com/blog/pedit-cow-cve/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: AppArmor bypass leveraging aa-exec was observed on $dest$. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: parent_process_name + type: process +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-46331 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_pedit/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux + test_type: unit diff --git a/detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml b/detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml new file mode 100644 index 0000000000..0b55d77607 --- /dev/null +++ b/detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml @@ -0,0 +1,79 @@ +name: Linux Auditd Possible Setuid Execve Privesc +id: e958e6ee-7c73-4eff-a4d9-43232d719b26 +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Raven Tait, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: The following detects privilege escalation via execve (syscall 59) where a process transitions from a non-root uid to euid=0 without a corresponding successful PAM authentication event (USER_AUTH, USER_ACCT, or CRED_ACQ) in the same audit session. Legitimate privilege elevation mechanisms such as sudo, su, and pkexec authenticate through PAM and generate these audit records tied to the session ID before granting elevated privileges. The absence of a matching successful PAM event alongside an effective UID change to root is anomalous and may indicate exploitation of a setuid binary, a kernel vulnerability, or another mechanism used to escalate privileges outside the normal authentication flow. +data_source: + - Linux Auditd Execve +search: >- + `linux_auditd` ( + (type=SYSCALL syscall="59" uid!="0" euid="0") + OR + (type IN ("USER_AUTH","USER_ACCT","CRED_ACQ") res="success") + ) + | eval is_suspicious_exec=if(type="SYSCALL" AND syscall="59" AND uid!="0" AND euid="0", 1, 0) + | eval is_successful_auth=if(type IN ("USER_AUTH","USER_ACCT","CRED_ACQ") AND res="success", 1, 0) + | stats + count(eval(is_suspicious_exec=1)) as exec_count + max(eval(if(is_suspicious_exec=1, _time, null()))) as lastTime + max(is_successful_auth) as has_successful_auth + min(eval(if(is_suspicious_exec=1, _time, null()))) as firstTime + values(eval(if(is_suspicious_exec=1, comm, null()))) as process_name + values(eval(if(is_suspicious_exec=1, euid, null()))) as euid + values(eval(if(is_suspicious_exec=1, exe, null()))) as process_path + values(eval(if(is_suspicious_exec=1, pid, null()))) as pid + values(eval(if(is_suspicious_exec=1, ppid, null()))) as ppid + values(eval(if(is_suspicious_exec=1, uid, null()))) as uid + by host ses + | where exec_count > 0 AND has_successful_auth != 1 + | rename host as dest, ses as session_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_possible_setuid_execve_privesc_filter` +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed. +known_false_positives: Processes with an unset audit session, such as cron jobs, that legitimately drop and reacquire root privileges outside of PAM, may trigger this detection and require filtering. +references: + - https://github.com/sgkdev/packet_edit_meme + - https://tuxcare.com/blog/pedit-cow-cve/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: $process_name$ was launched with euid 0 on [$dest$] without PAM auth. +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-46331 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_pedit/linux_auditd.log + source: auditd + sourcetype: auditd + test_type: unit diff --git a/detections/endpoint/linux_binary_launched_process_with_null_argv.yml b/detections/endpoint/linux_binary_launched_process_with_null_argv.yml index 0bde291492..6b1da8383a 100644 --- a/detections/endpoint/linux_binary_launched_process_with_null_argv.yml +++ b/detections/endpoint/linux_binary_launched_process_with_null_argv.yml @@ -1,8 +1,8 @@ name: Linux Binary Launched Process with Null Argv id: 0085652a-e682-45a2-a40c-5bb68b8f260e -version: 1 +version: 2 creation_date: '2026-05-12' -modification_date: '2026-05-12' +modification_date: '2026-07-17' author: Raven Tait, Splunk status: production type: TTP @@ -11,7 +11,7 @@ description: |- data_source: - Linux Messages Syslog search: | - sourcetype="linux_messages_syslog" "NULL argv" "empty string added" + `linux_syslog` "NULL argv" "empty string added" | rex field=_raw "process '(?<launching_process>[^']+)' launched '(?<launched_process>[^']+)' with NULL argv" | where isnotnull(launching_process) AND isnotnull(launched_process) | stats diff --git a/detections/endpoint/linux_pedit_offset_out_of_bounds.yml b/detections/endpoint/linux_pedit_offset_out_of_bounds.yml new file mode 100644 index 0000000000..b295103b10 --- /dev/null +++ b/detections/endpoint/linux_pedit_offset_out_of_bounds.yml @@ -0,0 +1,58 @@ +name: Linux Pedit Offset Out Of Bounds +id: 749d9bbf-cfa5-42d0-90e0-eb9300f7750a +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following detects a Linux kernel warning message containing "tc action pedit offset" and "out of bounds" logged to syslog, which indicates the act_pedit attempted to write past the bounds of an allocated packet buffer. This condition is associated with CVE-2026-46331, a kernel vulnerability that can be exploited via crafted pedit netlink configurations combined with page cache poisoning to achieve privilege escalation. The presence of this message on a host is a strong indicator that exploitation of this vulnerability, or triggering of the underlying vulnerable code path, has occurred. +data_source: + - Linux Messages Syslog +search: >- + `linux_syslog` "*tc action pedit offset*" "*out of bounds*" + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by dest _raw + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_pedit_offset_out_of_bounds_filter` +how_to_implement: To successfully implement this search, you need to have relevant kernel logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833). +known_false_positives: This is generated only when the kernel's act_pedit module encounters a write outside the writable SKB region. This never occurs in normal tc pedit usage. +references: + - https://tuxcare.com/blog/pedit-cow-cve/ + - https://github.com/sgkdev/packet_edit_meme +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Out-of-bounds write by act_pedit on $dest$ indicating possible privilege escalation. + entity: + field: dest + type: system + score: 50 +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-46331 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_pedit/syslog.log + source: /var/log/kern + sourcetype: linux_messages_syslog + test_type: unit diff --git a/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml b/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml index 3cf3bd124a..588b2269fe 100644 --- a/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml +++ b/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml @@ -1,8 +1,8 @@ name: Linux PF_ALG Registration Outside of Boot Window id: 8a9684ae-52e6-4a57-aea4-8a9f72942564 -version: 1 +version: 2 creation_date: '2026-05-11' -modification_date: '2026-05-11' +modification_date: '2026-07-17' author: Raven Tait, Splunk status: production type: TTP @@ -12,7 +12,7 @@ description: |- data_source: - Linux Messages Syslog search: | - sourcetype="linux_messages_syslog" "NET: Registered PF_ALG protocol family" + `linux_syslog` "NET: Registered PF_ALG protocol family" | rex field=_raw "kernel: \[\s*(?<uptime_seconds>[\d\.]+)\]" | eval uptime_seconds=tonumber(uptime_seconds) | where uptime_seconds > 300 diff --git a/macros/linux_syslog.yml b/macros/linux_syslog.yml new file mode 100644 index 0000000000..947cb06b77 --- /dev/null +++ b/macros/linux_syslog.yml @@ -0,0 +1,8 @@ +name: linux_syslog +id: 8d38dda6-b102-454e-87c4-5ccac5aac591 +version: 1 +creation_date: '2020-07-17' +modification_date: '2026-07-17' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. +definition: sourcetype="linux_messages_syslog" From 24d7259ca189e9a7ed547ffa330bbcabf51852fa Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Mon, 27 Jul 2026 00:52:54 -0700 Subject: [PATCH 045/164] Update data source TA and install.yml app versions (#4181) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- data_sources/azure_active_directory.yml | 2 +- ...e_directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- data_sources/azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_microsoftgraphactivitylogs.yml | 2 +- .../azure_active_directory_noninteractiveusersigninlogs.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- data_sources/crowdstrike_falcon_stream_alert.yml | 2 +- data_sources/crowdstrike_processrollup2.yml | 2 +- data_sources/linux_auditd_add_user.yml | 2 +- data_sources/linux_auditd_cwd.yml | 2 +- data_sources/linux_auditd_daemon_abort.yml | 2 +- data_sources/linux_auditd_daemon_end.yml | 2 +- data_sources/linux_auditd_daemon_start.yml | 2 +- data_sources/linux_auditd_execve.yml | 2 +- data_sources/linux_auditd_path.yml | 2 +- data_sources/linux_auditd_proctitle.yml | 2 +- data_sources/linux_auditd_service_stop.yml | 2 +- data_sources/linux_auditd_syscall.yml | 2 +- data_sources/linux_messages_syslog.yml | 2 +- data_sources/linux_secure.yml | 2 +- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/palo_alto_network_threat.yml | 2 +- data_sources/palo_alto_network_traffic.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 199 files changed, 199 insertions(+), 199 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index f3328a8bbc..c40126191c 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index a9511d9d9b..bd7fc59c23 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index 880aef37dd..dbe9bbafd8 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index fd63339bb3..d80e70b155 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index 4c3cbe5878..efe8b33ddb 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index e73a5fdbfe..47f47f1900 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 0369aac026..afce3a4582 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index b38bd36a87..55fa3c5e41 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index d250e861ac..a421c79763 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 63f6d6c21f..3f8eab8b67 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index a18640b739..1ad5447148 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index b344919b5b..dfd4ba9321 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index f9979ecf7d..e2a3e40ce3 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index b5512900a2..1a462fcf5d 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index e8d99ba572..1dd734b3c2 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index ab7ff1026d..bf04e2a317 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index 40ec3ef513..e08314d029 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 1ba2d214ef..44405c5e8b 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 703afa31c0..3d53d8c6c7 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index 362a3f413c..67d95cdb65 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index 81cf1dd57e..c4f6cc2598 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index ad3e9f7005..010c2162c1 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 65395481c2..8b13e8bdc2 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 043a0c779f..55c95ea4ad 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 12c0a6eb1b..3809b00a30 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 02b74f5048..7270838ad1 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 1c52a641a2..614f3fd068 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 8eab3f8a75..6562a321da 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index fb938e6771..84c522f2f4 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 7165cf16f2..4929e2e883 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 52e84b8efb..b8105c4862 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index 6fbcecf73d..c234e022e6 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index bba6d81026..e52c960d46 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index 950a8a1b2f..abcf17e438 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 874c871b8c..c88017ac48 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 627d0ff2de..ee363cb8cd 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 1d7fb02b10..d19da791f6 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index b49e80f1f8..2346b22494 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 05e052adf0..38d1565418 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 0c206891b4..c39f7ca141 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index d2a7ae0fd7..060a86c2dc 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index 2e646c9b8d..924c2c1367 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index 1eb10a3089..83b42f8449 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 62d2f6d78b..06a7cd7584 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 8b0a18eb83..a6b0eeca89 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 56005c7534..272e734d13 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 8b217dd583..afebb51c8f 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 42c1c946e8..172b11719d 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index ea9ceda6cb..c24c6c2417 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index a10cdd3abb..ac76f2f355 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 43d50753ea..9f834c10ce 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index e1ac9e542b..22e5498275 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 3d3dbcab74..37d43a3286 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 7053746645..34e190129c 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 9f5f3d620d..c3264444c1 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 3edf234121..7858189b11 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 026fcfd469..9790a74d67 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 38503edd37..2e58b10a33 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index c0a40b5370..755e03f508 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index a2d19c3b9a..cd980da894 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index fba9a7abde..eb0cdc7ecf 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.2.0 + version: 8.1.2 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index 3d7464278d..b2bda6430e 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - AwsAccountId diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index a0a2532611..4b353862ea 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index d4c45e3cb9..182d512dca 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 964ffd4bf8..5031b5cd33 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index d5efa8b2be..f0c01197f6 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index d15f4e6109..c5e2c3a4e5 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index eb4f327ebe..7b4411afbd 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 6bb5aac90c..1461a8eaa6 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index f863f7d359..177b30e212 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 26056aaaf7..b7fd87116e 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index a31f829e9c..22983a3d9f 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 9e8af8668d..65cb093d4f 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 16df973510..8c5adbf8ae 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 2db4d47a9c..da60f90a28 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 1689413757..9a0c666f20 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 831876c413..d6888c0dee 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index cbf230589f..b0ae6b37c9 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index b98d46e5e2..7a086791e4 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 56e530b66f..f0ca04a229 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index aaba9d6bf0..ce39762a76 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index fdb84eb9cb..fb083554f3 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 8098881c4d..1c61b96dac 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 17812205b6..c1d309bda9 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 6f196a610a..5b89633bdb 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - column - action diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 9132278b02..dceb6eef93 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -17,7 +17,7 @@ separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.1.1 + version: 3.0.0 fields: - action - description diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index d2f90cb5cf..24d29df959 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -18,7 +18,7 @@ separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.1.1 + version: 3.0.0 fields: - AuthenticationId - AuthenticationId_meaning diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index cf1a8a10f0..164e9aefb7 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index bb4692329a..afbe0ec701 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index f82333876b..9b83e49dc1 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index bdca049e91..f7b4fcf4dd 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 5b58a4785a..9f96075a6e 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index ed4e76f993..1d5c039877 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 64f681c8dc..6f0953cec0 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 842bd99048..44e2a8935b 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 02f1314857..1db5103e14 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index c385210b04..b5d9647033 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index c84136000d..4990b9710d 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -15,7 +15,7 @@ sourcetype: linux_messages_syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - _time - action diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 56434973a9..b8dd8ae5ba 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - _time - action diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 7b095e9329..141ebdf0de 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index b6673df534..da24c4688c 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index 12a1f1dc03..e4ec349eb5 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index 7ed3330faa..b83bd67d0b 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.2.1 + version: 3.1.0 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 0f6d642ea8..00e9798ece 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.2.1 + version: 3.1.0 fields: - _time - date_hour diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 394ee4689e..6a20ab8128 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 10f397dfe8..7e1ec4fde7 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 1134642e1e..4ef6ecee00 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index c819d61225..fb960b1d42 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 0dc7ec7343..9107707eaf 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 25989597c4..a98f34690b 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index 8b97db5796..b45b9b50fa 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 954960673c..869197ab81 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index e1fed6202a..792a15ebbc 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index fd04a03871..22e3b71725 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index e015fea468..00920b4b37 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index cea7a04b89..2701795166 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index d190dd24f6..f4e7771023 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 44dbde3791..14d92e22a7 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index cf58df9f88..011347afb2 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 24794c9317..9c97a01efe 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index e24a33ffc0..77928d8273 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event> diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 50358cbb4a..b0b5c2cef0 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 4d880bdfc9..8d9767ba9c 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 7ce4f4f10b..7b59c9cd6b 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index d9c500e81b..1a813f46f9 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 052c42d354..88cb4531d3 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 7ca20f0675..3b54c95906 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 0d27f6ebcd..882e7a7bd0 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 6d6662b271..257bd4a5d4 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 492b6118b0..529620eb60 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index eaa8668f29..d952de1f7e 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index dbff470f19..6bd7d957fc 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 95c41e545d..3dbf23664f 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 90fec45a0a..8586c6984d 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index a19e174445..3971f62bfc 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 094b017f2f..28e5d9fead 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index 92817c9c7d..e8c1fb0efb 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index aef95a0736..6b8fa7d829 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index 2aee0b516c..c0dc0121e4 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index a4b77b42f4..f74d26c94a 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index d75420c82a..280d7f8262 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index d968667265..642687b596 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index a36980f988..3b4b6a9c06 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 590d5e1f8c..a80ed23a9b 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index fdb23972cb..4dc60cd9bd 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 9824e45fd8..7184ff77e3 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 8efa4d630a..5c1d729155 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 19c9db852d..06b3adb988 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 049f915001..31484a3587 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 4778011edf..26eb1728db 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 2e1ab15fd5..0b06b7823a 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 4b4a6cb80c..ca05c7b840 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index bffa3f61d6..6ddc2aba57 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 087aff4eea..0aa2c2f0b7 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index 0e6346d3b2..bcba79a79d 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 06c4b66e66..9487a6ac52 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 87ad0bceae..30f8bc23e8 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 5c7de0fd65..d95f852eb8 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 4c27227db2..f128bbfcc4 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 9db856f358..fb6f1f3ca8 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index d055166b55..b0f6314703 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index eb0238ac90..7b643fb3d0 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 513872af7e..eb26156fe9 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index eca1bb9609..216eb54d2c 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 37cd80c800..8b61381ede 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 48f80c0979..4dbe460a36 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index 8f7b0b077e..c53348491f 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index d8110c1a28..9db0814db3 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index d11908d257..0d954d3b5c 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 61f7a15c8e..2b1506eda9 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 41d424b7e8..16751ea4ef 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index fd970cd422..408aaa466b 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index 7e55eadbc3..ed8f3691a8 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index b0f7b5fe5c..4b239b5056 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 301fcb7215..8a945e0fe8 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 222bc3fad3..70bae43f05 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index feb4495106..8eebe0e5a9 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index ca4e0c7c95..bdd7735a81 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index e33210fe21..9379641c7d 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 7646c112a2..2016e280f6 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 44ee333e11..2d9e806305 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 2b0894834e..b10ef8870b 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 67478d0f08..961be864ee 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index ab04793a83..b2035008e4 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 5340ac3d62..253ce10397 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index abf49c3db8..f5f3cf1116 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 2a40fdcf81..393098f288 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index dbdf8114b3..1647d2e832 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index 6ccea0b238..faea29ccad 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 47015e8dd1..49df88f658 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 31d4f0ca60..642359a985 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 728e981ba5..dd3e3849ea 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index b14cad1c4c..0cf395b1d2 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 552b3d1027..518d67eacf 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 95bbb82590..a1fda46fe8 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index 618165e9f7..e7fe0ff722 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index bd708a219d..01ff84004b 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 6306f875ca..a3412a3b42 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 85da612242..8c6977fd3a 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ComputerName From 5b38d2f543aa02da0a1e2173d2c97d406a223c47 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Mon, 27 Jul 2026 20:02:14 +0200 Subject: [PATCH 046/164] Update Analytics - Batch 6.3 (#4157) * update file event analytics - batch 1 * Fix #4061 * Fix #4126 * update NVM detections to new sourcetype * tune LLM analytics * fix sourcetype * add missing DS for EID 26 * Fix #4178 * Fix #4139 * Fix #4084 * Fix #4148 * Update windows_appcertdll_modification_via_registry.yml * Fix #4078 * Update domain_controllers.csv * revert version bump * Update windows_curl_upload_to_remote_destination.yml * Update windows_curl_upload_to_remote_destination.yml --- ...co_network_visibility_module_flow_data.yml | 15 ++-- ...isco_network_visibility_module_osquery.yml | 14 +-- ...itten_outside_of_the_outlook_directory.yml | 75 +++++++++++----- .../endpoint/attacker_tools_on_endpoint.yml | 4 +- .../endpoint/batch_file_write_to_system32.yml | 64 +++++++++---- ...m___curl_execution_with_insecure_flags.yml | 4 +- ...llation_of_typosquatted_python_package.yml | 4 +- ...a_network_execution_without_url_in_cli.yml | 4 +- ...twork_binary_making_network_connection.yml | 4 +- ...outbound_connection_to_suspicious_port.yml | 4 +- ...rclone_execution_with_network_activity.yml | 4 +- ...use_of_mshtml_dll_for_payload_download.yml | 4 +- ...om_archive_triggering_network_activity.yml | 4 +- ...ous_download_from_file_sharing_website.yml | 4 +- ...ous_file_download_via_headless_browser.yml | 4 +- ...k_connection_from_process_with_no_args.yml | 4 +- ...network_connection_initiated_via_msxsl.yml | 4 +- ...rk_connection_to_ip_lookup_service_api.yml | 4 +- ...ver_download_from_file_sharing_website.yml | 4 +- .../endpoint/common_ransomware_extensions.yml | 90 ++++++++++--------- .../endpoint/common_ransomware_notes.yml | 13 ++- .../detect_html_help_url_in_command_line.yml | 4 +- .../detect_mshta_url_in_command_line.yml | 2 +- .../detect_rclone_command_line_usage.yml | 4 +- .../endpoint/llm_model_file_creation.yml | 42 +++++++-- .../local_llm_framework_dns_query.yml | 64 +++++++++---- ...svchost_lolbas_execution_process_spawn.yml | 71 +++++++++++---- .../time_provider_persistence_registry.yml | 36 +++++++- ...pcertdll_modification_via_command_line.yml | 4 +- ...s_appcertdll_modification_via_registry.yml | 80 +++++++++++++++++ ...ndows_curl_download_to_suspicious_path.yml | 2 +- ...dows_curl_upload_to_remote_destination.yml | 43 +++++++-- .../windows_file_download_via_certutil.yml | 4 +- .../windows_file_download_via_powershell.yml | 4 +- ...e_without_extension_in_critical_folder.yml | 49 +++++++--- ...ttp_network_communication_from_msiexec.yml | 4 +- ..._installutil_remote_network_connection.yml | 4 +- ...indows_installutil_url_in_command_line.yml | 4 +- ...indows_kerberos_local_successful_logon.yml | 54 +++++++---- .../windows_local_llm_framework_execution.yml | 28 ++++-- .../windows_mark_of_the_web_bypass.yml | 30 ++++--- ..._script_deleted_by_non_msiexec_process.yml | 7 +- .../windows_msiexec_remote_download.yml | 4 +- ...rshell_fakecaptcha_clipboard_execution.yml | 4 +- ...ows_process_with_namedpipe_commandline.yml | 53 +++++++++-- ...ows_rdp_automaticdestinations_deletion.yml | 20 ++++- .../windows_rdp_cache_file_deletion.yml | 30 ++++++- ..._defender_update_activity_in_inetcache.yml | 6 +- ...s_winscp_configuration_security_access.yml | 8 +- .../endpoint/wmic_xsl_execution_via_url.yml | 4 +- lookups/csv/domain_controllers.csv | 2 + lookups/csv/domain_controllers.yml | 9 ++ lookups/csv/ransomware_notes_lookup.csv | 1 - lookups/csv/ransomware_notes_lookup.yml | 4 +- ...sco_network_visibility_module_flowdata.yml | 6 +- 55 files changed, 732 insertions(+), 290 deletions(-) create mode 100644 detections/endpoint/windows_appcertdll_modification_via_registry.yml create mode 100644 lookups/csv/domain_controllers.csv create mode 100644 lookups/csv/domain_controllers.yml diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index a44e6f1f6b..a34facebf4 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -1,19 +1,18 @@ name: Cisco Network Visibility Module Flow Data id: d49bcd3c-da06-41c6-b33e-8b8d23078f68 -version: 2 +version: 3 creation_date: '2025-06-30' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk description: Data source object for Netflow events from Cisco Network Visibility Module source: not_applicable -sourcetype: cisco:nvm:flowdata +sourcetype: cisco:nvm:flowdata:v2 supported_TA: - - name: Cisco NVM Add-on for Splunk - url: https://splunkbase.splunk.com/app/4221 - version: 4.0.7 + - name: Cisco Security Cloud + url: https://splunkbase.splunk.com/app/7404 + version: 3.6.5 fields: - action - - aditional_logged_in_user_list - aliul - bytes - bytes_in @@ -147,4 +146,4 @@ fields: - user output_fields: - dest -example_log: 'Jun 26 16:09:18 127.0.0.1 Jun 26 16:09:18 ip-172-31-30-201 fv="nvzFlow_v9" pr="6" sa="172.16.3.110" sp="5203" da="140.82.112.3" dp="443" fd="1" fss="1750954134" fst="Thu Jun 26 16:08:54 2025" fes="1750954134" fet="Thu Jun 26 16:08:54 2025" hh="''" hm="''" ht="''" udid="10E8A7F940225180BFDB748D2AE336EA7285CB8C" liuid="EC2AMAZ-E56LIG5\Administrator" liuida="EC2AMAZ-E56LIG5" liuidp="Administrator" liuat="2" pa="EC2AMAZ-E56LIG5\Administrator" paa="EC2AMAZ-E56LIG5" pap="Administrator" puat="8194" pn="msiexec.exe" ph="23EC37A4DF21893A1B3B6F5F72B2D78918E86C3A90F9664F8248A2C8219F889A" ppa="EC2AMAZ-E56LIG5\Administrator" ppuat="8194" ppn="cmd.exe" pph="41871DADE953D9F40F4AA445FC19982AB59D263C8AA93D7F67A1451663A09A57" ibc="0" obc="0" ds="us-east-2.compute.internal" dh="github.com" iid="4" mnl="''" mhl="''" fsms="1750954134331" fems="1750954134340" pid="8496" ppath="C:\Windows\system32\msiexec.exe" parg=" /i \"https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/src/T1218.007_JScript.msi\"" ppid="9232" pppath="C:\Windows\system32\cmd.exe" aliul="''" pil="12288" ppil="12288" fsg="1" puid="071161F29663831BB4A1C0FADA9805E0"' +example_log: '{ "fv": "nvzFlow_v11", "pr": "6", "sa": "10.10.0.38", "sp": "37351", "da": "104.114.110.196", "dp": "80", "fd": "1", "fss": "1784017733", "fst": "Tue Jul 14 13:58:53 2026", "fes": "1784017793", "fet": "Tue Jul 14 13:59:53 2026", "hh": "tile-service.weather.microsoft.com", "hm": "GET", "ht": "/en-GB/livetile/preinstall", "udid": "D5E5634FDBEE82655C9C0E7523CDCE62A8249A1C", "liuid": "WIN-ANIKET\\Hostscan", "liuida": "WIN-ANIKET", "liuidp": "Hostscan", "liuat": "2", "pa": "WIN-ANIKET\\Hostscan", "puat": "2", "pn": "svchost.exe", "ph": "B0B36BFF7AE4057F687D839CD4B3D81159AB646F1EE1B22106A927E93DECBB61", "pid": "3040", "ppath": "C:\\Windows\\System32\\svchost.exe", "parg": "-k UnistackSvcGroup -s WpnUserService", "ppn": "services.exe", "ppid": "684", "pppath": "C:\\Windows\\System32\\services.exe", "ibc": "7660", "obc": "213", "ds": "cisco.com", "dh": "tile-service.weather.microsoft.com", "iid": "50", "mnl": "wpnuserservice.dll", "mhl": "8F571F1D23DE5D0C223338BDD341892CCBC62FDE443499AC373B6A621F58A332", "fsms": "1784017733536", "fems": "1784017793545", "pil": "8192", "ppil": "16384", "fsg": "0", "puid": "E89CC0DBD1F48055BB4FA09268E9B51D", "eveuuid": "00000000000000000000000000000000" }' diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 7ee5204cd9..80e6c678e9 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -1,16 +1,16 @@ name: Cisco Network Visibility Module OSquery id: d59bcd3c-da06-41c6-b33e-8b8d23078f68 -version: 2 +version: 3 creation_date: '2025-06-30' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk description: Data source object for OSquery events from Cisco Network Visibility Module source: not_applicable -sourcetype: cisco:nvm:osquery +sourcetype: cisco:nvm:osquery:v2 supported_TA: - - name: Cisco NVM Add-on for Splunk - url: https://splunkbase.splunk.com/app/4221 - version: 4.0.7 + - name: Cisco Security Cloud + url: https://splunkbase.splunk.com/app/7404 + version: 3.6.5 fields: - current_page - date_hour @@ -49,4 +49,4 @@ fields: - udid output_fields: - query_json_response -example_log: 'Jun 30 09:20:43 127.0.0.1 Jun 30 09:20:43 ip-172-31-30-201 fv="nvzFlow_v8" udid="10E8A7F940225180BFDB748D2AE336EA7285CB8C" qv="5.5.1-dirty" qid="38654705666" qt="1751275242" qpi="1" qpn="1" qjr="[{\"active\":\"1\",\"autoupdate\":\"1\",\"creator\":\"null\",\"description\":\"\",\"disabled\":\"0\",\"identifier\":\"addons-search-detection@mozilla.com\",\"location\":\"app-builtin\",\"name\":\"Add-ons Search Detection\",\"native\":\"\",\"path\":\"null\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"2.0.0\",\"visible\":\"1\"},{\"active\":\"0\",\"autoupdate\":\"1\",\"creator\":\"Mozilla <screenshots-feedback@mozilla.com>\",\"description\":\"Take clips and screenshots from the Web and save them temporarily or permanently.\",\"disabled\":\"1\",\"identifier\":\"screenshots@mozilla.org\",\"location\":\"app-system-defaults\",\"name\":\"Firefox Screenshots\",\"native\":\"\",\"path\":\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\screenshots@mozilla.org.xpi\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"39.0.1\",\"visible\":\"1\"},{\"active\":\"1\",\"autoupdate\":\"1\",\"creator\":\"null\",\"description\":\"\",\"disabled\":\"0\",\"identifier\":\"formautofill@mozilla.org\",\"location\":\"app-system-defaults\",\"name\":\"Form Autofill\",\"native\":\"\",\"path\":\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"1.0.1\",\"visible\":\"1\"},{\"active\":\"1\",\"autoupdate\":\"1\",\"creator\":\"null\",\"description\":\"Fixes for web compatibility with Picture-in-Picture\",\"disabled\":\"0\",\"identifier\":\"pictureinpicture@mozilla.org\",\"location\":\"app-system-defaults\",\"name\":\"Picture-In-Picture\",\"native\":\"\",\"path\":\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\pictureinpicture@mozilla.org.xpi\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"1.0.0\",\"visible\":\"1\"},{\"active\":\"1\",\"autoupdate\":\"1\",\"creator\":\"null\",\"description\":\"Urgent post-release fixes for web compatibility.\",\"disabled\":\"0\",\"identifier\":\"webcompat@mozilla.org\",\"location\":\"app-system-defaults\",\"name\":\"Web Compatibility Interventions\",\"native\":\"\",\"path\":\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\webcompat@mozilla.org.xpi\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"137.7.0\",\"visible\":\"1\"},{\"active\":\"0\",\"autoupdate\":\"1\",\"creator\":\"Thomas Wisniewski <twisniewski@mozilla.com>\",\"description\":\"Report site compatibility issues on webcompat.com\",\"disabled\":\"1\",\"identifier\":\"webcompat-reporter@mozilla.org\",\"location\":\"app-system-defaults\",\"name\":\"WebCompat Reporter\",\"native\":\"\",\"path\":\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\webcompat-reporter@mozilla.org.xpi\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"2.1.0\",\"visible\":\"1\"}]"' +example_log: '{ "fv": "nvzFlow_v8", "udid": "D5E5634FDBEE82655C9C0E7523CDCE62A8249A1C", "qv": "5.5.1-dirty", "qid": "38654705666", "qt": "1784017742", "qpi": "1", "qpn": "1", "qjr": "[{\"active\":\"1\",\"autoupdate\":\"1\",\"identifier\":\"addons-search-detection@mozilla.com\",\"location\":\"app-builtin-addons\",\"name\":\"Add-ons Search Detection\",\"type\":\"extension\",\"uid\":\"1001\",\"version\":\"3.0.0\",\"visible\":\"1\"},{\"active\":\"1\",\"identifier\":\"formautofill@mozilla.org\",\"name\":\"Form Autofill\",\"version\":\"1.0.1\"}]"}' diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index c38c5a7e73..229731bdff 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -1,40 +1,60 @@ name: Email files written outside of the Outlook directory id: 8d52cf03-ba25-4101-aa78-07994aed4f74 -version: 12 +version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-07-02' author: Bhavin Patel, Splunk -status: experimental -type: TTP -description: The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories. It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*". This activity is significant as it may indicate data exfiltration or unauthorized access to email data. If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network. +status: production +type: Anomaly +description: |- + The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories. + It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*". + This activity is significant as it may indicate data exfiltration or unauthorized access to email data. + If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network. data_source: - Sysmon EventID 11 search: |- - | tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - WHERE ( - Filesystem.file_name=*.pst - OR - Filesystem.file_name=*.ost - ) - Filesystem.file_path != "C:\Users\*\My Documents\Outlook Files\*" Filesystem.file_path!="C:\Users\*\AppData\Local\Microsoft\Outlook*" - BY Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path Filesystem.file_acl - Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product + | tstats `security_content_summariesonly` + count values(Filesystem.file_path) as file_path + min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.action IN ( + "created", + "modified" + ) + Filesystem.file_name IN ( + "*.pst", + "*.ost" + ) + NOT Filesystem.file_path IN ( + "C:\\Users\\*\\My Documents\\Outlook Files\\*", + "C:\\Users\\*\\AppData\\Local\\Microsoft\\Outlook*" + ) + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `email_files_written_outside_of_the_outlook_directory_filter` how_to_implement: To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. -known_false_positives: Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search. +known_false_positives: |- + Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search. + You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. references: [] -finding: - title: Email files written outside of Outlook's Directory on $dest$ - entity: - field: dest - type: system - score: 50 +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A new email file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$. analytic_story: - Collection and Staging asset_type: Endpoint @@ -46,3 +66,10 @@ product: - Splunk Cloud category: application security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.001/windows_email_files_outside_email_dir/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index c2a61d01a2..2f1379ec50 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -2,7 +2,7 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 version: 19 creation_date: '2021-07-12' -modification_date: '2026-07-01' +modification_date: '2026-07-14' author: Bhavin Patel, Splunk, sventec, Github Community status: production type: TTP @@ -103,5 +103,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 5bd5039da0..86e914066d 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -1,17 +1,53 @@ name: Batch File Write to System32 id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 -version: 14 +version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-07-02' author: Steven Dick, Michael Haag, Rico Valdez, Splunk status: production -type: TTP -description: The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. It leverages data from the Endpoint datamodel, focusing on process and filesystem events to identify this behavior. This activity is significant because writing batch files to system directories can be indicative of malicious intent, such as persistence mechanisms or system manipulation. If confirmed malicious, this could allow an attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire system. +type: Anomaly +description: |- + The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. It leverages data from the Endpoint datamodel, focusing on process and filesystem events to identify this behavior. + This activity is significant because writing batch files to system directories can be indicative of malicious intent, such as persistence mechanisms or system manipulation. + If confirmed malicious, this could allow an attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire system. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*","*\\syswow64\\*") Filesystem.file_name="*.bat" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `batch_file_write_to_system32_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: It is possible for this search to generate a finding event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem where + + Filesystem.action IN ( + "created", + "modified" + ) + Filesystem.file_path IN ( + "*:\\Windows\\System32\\*", + "*:\\Windows\\SysWOW64\\*" + ) + Filesystem.file_name IN ( + "*.bat", + "*.cmd" + ) + + by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash + Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `batch_file_write_to_system32_filter` +how_to_implement: |- + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + You must also be ingesting the Endpoint.Filesystem data source. +known_false_positives: |- + Some batch files are written to the system32 directory tree for legitimate purposes, such as system maintenance or configuration. Investigate the batch file to determine if it is legitimate and modify the search to add exclusions, as necessary. references: [] drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" @@ -22,21 +58,15 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. + score: 20 + message: A new batch file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$. threat_objects: - - field: file_name - type: file_name + - field: file_path + type: file_path analytic_story: - SamSam Ransomware - Compromised Windows Host diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 6712f91f5c..4f2287fd2b 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 version: 8 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -94,5 +94,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index 8a805e5448..1230dc1fe3 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Installation of Typosquatted Python Package id: 5e3f6b44-42cb-4f8a-99f0-59e78a52ea1d version: 5 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -92,5 +92,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index 642eb25100..39f753ba7e 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -2,7 +2,7 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -99,5 +99,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index 72f181766d..30d1478029 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -95,5 +95,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml index e754472a80..012a98db4f 100644 --- a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml +++ b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Outbound Connection to Suspicious Port id: fc32a8d5-bc79-4437-b48f-4646ab7bed9d version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -91,5 +91,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index 45218455c8..d707ed4745 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a version: 7 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -102,5 +102,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index 89cc32f489..3b0f0d51b9 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -89,5 +89,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index 7ad4e93392..0072fc506e 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -88,5 +88,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 8166c79a5a..88bfa5cba7 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 version: 7 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -109,5 +109,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index b3ba65c990..7ea531ccb1 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -127,5 +127,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index 1c6eb91265..30cb586fc2 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -98,5 +98,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index 97666a50e2..8fe5860f2b 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -91,5 +91,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index 7cf11c08ef..681ce03876 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f version: 8 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe status: production type: Anomaly @@ -104,5 +104,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index 829b6421f0..bdcf425a92 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e version: 7 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -98,5 +98,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index be82aaebee..495dfc0599 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,57 +1,59 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: 21 +version: 22 creation_date: '2019-10-16' -modification_date: '2026-05-13' -author: David Dorsey, Michael Haag, Splunk, Steven Dick +modification_date: '2026-07-02' +author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns. This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption. If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability. +description: |- + The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns. + This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption. + If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability. data_source: - Sysmon EventID 11 search: | | tstats `security_content_summariesonly` - min(_time) as firstTime - max(_time) as lastTime - count latest(Filesystem.user) as user + count min(_time) as firstTime + max(_time) as lastTime + latest(Filesystem.user) as user values(Filesystem.file_path) as file_path - from datamodel=Endpoint.Filesystem - where NOT Filesystem.file_name IN ( - "*.bat", - "*.cmd", - "*.com", - "*.cpl", - "*.dll", - "*.doc", - "*.docx", - "*.exe", - "*.gif", - "*.jar", - "*.jpeg", - "*.jpg", - "*.js", - "*.lnk", - "*.pif", - "*.png", - "*.ppt", - "*.pptx", - "*.ps1", - "*.psm1", - "*.scr", - "*.sys", - "*.txt", - "*.vbs", - "*.wsf", - "*.xls", - "*.xlsx" - ) - by Filesystem.action Filesystem.dest - Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size - Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.action IN ( + "created", + "modified" + ) + NOT Filesystem.file_name IN ( + "*.7z", "*.aac", "*.appx", "*.appxbundle", "*.asc", "*.asm", "*.avi", + "*.bak", "*.bat", "*.bin", "*.bmp", "*.bz2", "*.cab", "*.cer", + "*.cfg", "*.cmd", "*.com", "*.conf", "*.cpp", "*.crt", "*.cs", + "*.csh", "*.css", "*.csv", "*.cxx", "*.dat", "*.deb", "*.der", + "*.diff", "*.dll", "*.doc", "*.docm", "*.docx", "*.dot", "*.dotm", + "*.dotx", "*.drv", "*.eml", "*.eps", "*.exe", "*.flac", "*.gif", + "*.go", "*.gz", "*.h", "*.hpp", "*.htm", "*.html", "*.ico", "*.ics", + "*.ini", "*.iso", "*.jar", "*.java", "*.jpeg", "*.jpg", "*.js", "*.json", + "*.key", "*.ksh", "*.ldf", "*.lib", "*.log", "*.lnk", "*.m4a", "*.m4v", + "*.md", "*.mdb", "*.mdf", "*.mht", "*.mhtml", "*.mkv", "*.mov", "*.mp3", + "*.mp4", "*.mpeg", "*.mpg", "*.msi", "*.msix", "*.msixbundle", "*.msg", + "*.odp", "*.ods", "*.odt", "*.one", "*.ost", "*.otf", "*.pdf", "*.pem", + "*.pfx", "*.php", "*.pif", "*.pl", "*.png", "*.pot", "*.potm", "*.potx", + "*.ppam", "*.pps", "*.ppsm", "*.ppsx", "*.ppt", "*.pptm", "*.pptx", "*.ps1", + "*.ps1xml", "*.psd1", "*.psm1", "*.pst", "*.pub", "*.py", "*.pyc", "*.rar", + "*.reg", "*.rpm", "*.rss", "*.rtf", "*.scr", "*.sh", "*.sql", "*.svg", + "*.swift", "*.sys", "*.tar", "*.tgz", "*.tif", "*.tiff", "*.toml", "*.ttf", + "*.txt", "*.url", "*.vb", "*.vbe", "*.vbs", "*.vcxproj", "*.vhd", "*.vhdx", + "*.wav", "*.webm", "*.webp", "*.wim", "*.wsf", "*.xlam", "*.xls", "*.xlsb", + "*.xlsm", "*.xlsx", "*.xlt", "*.xltm", "*.xltx", "*.xml", "*.xps", + "*.yaml", "*.yml", "*.zip" + ) + BY Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | rex field=file_name "(?<file_extension>(\.[^\.]+){1,2})$" | lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index 9a44d99080..73d3d89d0f 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -1,8 +1,8 @@ name: Common Ransomware Notes id: ada0f478-84a8-4641-a3f1-d82362d6bd71 -version: 15 +version: 16 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-07-02' author: David Dorsey, Splunk status: production type: Hunting @@ -24,8 +24,13 @@ search: | values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path - from datamodel=Endpoint.Filesystem - where [ + + FROM datamodel=Endpoint.Filesystem WHERE + Filesystem.action IN ( + "created", + "modified" + ) + [ | inputlookup ransomware_notes_lookup | search status=true | fields ransomware_notes diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 4a0748250d..b12bf89d2b 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Detect HTML Help URL in Command Line id: 8c5835b9-39d9-438b-817c-95f14c69a31e version: 17 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP @@ -87,5 +87,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index f497bd613a..a38dbcb988 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -92,5 +92,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 9192e27b63..70273452ae 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -2,7 +2,7 @@ name: Detect RClone Command-Line Usage id: 32e0baea-b3f1-11eb-a2ce-acde48001122 version: 19 creation_date: '2021-05-13' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP @@ -102,5 +102,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/llm_model_file_creation.yml b/detections/endpoint/llm_model_file_creation.yml index 8a26d5b263..27abf9c525 100644 --- a/detections/endpoint/llm_model_file_creation.yml +++ b/detections/endpoint/llm_model_file_creation.yml @@ -1,9 +1,9 @@ name: LLM Model File Creation id: 23e5b797-378d-45d6-ab3e-d034ca12a99b -version: 2 +version: 3 creation_date: '2025-11-24' -modification_date: '2026-05-13' -author: Rod Soto +modification_date: '2026-07-15' +author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Hunting description: | @@ -17,12 +17,36 @@ search: | | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ( - "*.gguf*", - "*ggml*", - "*Modelfile*", - "*safetensors*" + from datamodel=Endpoint.Filesystem where + + ( + Filesystem.file_name IN ( + "*.gguf", + "*.safetensors", + "*ggml.dll", + "*modelfile*" + ) + OR + ( + Filesystem.file_name = "ggml-*" + Filesystem.file_name = "*.dll" + ) + ) + NOT Filesystem.file_name IN ( + "__PSScriptPolicyTest*", + "*.csv", + "*.doc", + "*.docx", + "*.jpeg", + "*.jpg", + "*.pdf", + "*.png", + "*.ppt", + "*.pptx", + "*.py", + "*.xls", + "*.xlsx", + "*Bentley.Civil*" ) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path diff --git a/detections/endpoint/local_llm_framework_dns_query.yml b/detections/endpoint/local_llm_framework_dns_query.yml index 4e7d9bedfa..e4d3bad555 100644 --- a/detections/endpoint/local_llm_framework_dns_query.yml +++ b/detections/endpoint/local_llm_framework_dns_query.yml @@ -1,9 +1,9 @@ name: Local LLM Framework DNS Query id: d7ceffc5-a45e-412b-b9fa-2ba27c284503 -version: 2 +version: 3 creation_date: '2025-11-24' -modification_date: '2026-05-13' -author: Rod Soto +modification_date: '2026-07-15' +author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Hunting description: | @@ -16,30 +16,58 @@ search: | `sysmon` EventCode=22 QueryName IN ( + "*anthropic*", + "*api.openrouter*", + "*civitai*", + "*dashscope.aliyuncs*", + "*gpt4all*", "*huggingface*", - "*ollama*", "*jan.ai*", - "*gpt4all*", - "*nomic*", "*koboldai*", "*lmstudio*", "*modelscope*", - "*civitai*", + "*nomic.ai*", + "*ollama*", "*oobabooga*", - "*replicate*", - "*anthropic*", "*openai*", "*openrouter*", - "*api.openrouter*", - "*aliyun*", - "*alibabacloud*", - "*dashscope.aliyuncs*" + "*replicate*", + "*tongyi*" ) - NOT Image IN ( - "*\\MsMpEng.exe", - "C:\\ProgramData\\*", - "C:\\Windows\\System32\\*", - "C:\\Windows\\SysWOW64\\*" + NOT ( + Image IN ( + "*\\360se.exe", "*\\arc.exe", "*\\atlas.exe", "*\\avastbrowser.exe", + "*\\avgbrowser.exe", "*\\blpbrowser.exe", "*\\brave.exe", "*\\braveupdate.exe", + "*\\chrome.exe", "*\\chromium.exe", "*\\Cisco\\Cisco Secure Client\\ThousandEyes Endpoint Agent\\*", + "*\\coccoc.exe", "*\\dragon.exe", "*\\duckduckgo.exe", "*\\epic.exe", + "*\\firefox.exe", "*\\ghost.exe", "*\\iexplore.exe", "*\\iridium.exe", + "*\\iron.exe", "*\\maxthon.exe", "*\\microsoftedge.exe", "*\\microsoftedgeupdate.exe", + "*\\msedge.exe", "*\\msedgewebview2.exe", "*\\MsMpEng.exe", "*\\opera_autoupdate.exe", + "*\\opera.exe", "*\\perplexity.exe", "*\\rave.exe", "*\\safari.exe", "*\\shift.exe", + "*\\sidekick.exe", "*\\thorium.exe", "*\\torch.exe", "*\\vivaldi.exe", + "*\\wavebrowser.exe", "*\\whale.exe", "*\\zen.exe", "C:\\ProgramData\\*", + "C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*" + ) + OR + ( + Image IN ("*\\AnthropicClaude\\Update.exe", "*\\claude.exe") + QueryName = "anthropic.com" + ) + OR + ( + Image = "*\\lm studio.exe" + QueryName = "lmstudio.ai" + ) + OR + ( + Image IN ("*\\ollama app.exe", "*\\ollama.exe") + QueryName = "ollama.com" + ) + OR + ( + Image IN ("*\\chatgpt.exe", "*\\codex.exe") + QueryName = "openai.com" + ) ) | stats count min(_time) as firstTime diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index 686d98b1ac..02c80f9149 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -1,29 +1,61 @@ name: Svchost LOLBAS Execution Process Spawn id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 14 +version: 15 creation_date: '2021-11-23' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts. If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk. +description: |- + The following analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts. + If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE ( - Processes.parent_process_name=svchost.exe - ) - (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.parent_process = "*" + Processes.parent_process_name = "svchost.exe" + Processes.process_name IN ( + "At.exe", "Atbroker.exe", "Bash.exe", "Bitsadmin.exe", "Certoc.exe", "Cmstp.exe", + "Diskshadow.exe", "Dnscmd.exe", "Extexport.exe", "Forfiles.exe", "Ftp.exe", + "Gpscript.exe", "Hh.exe", "Ie4uinit.exe", "Ieexec.exe", "Infdefaultinstall.exe", + "Installutil.exe", "Mavinject.exe", "Microsoft.Workflow.Compiler.exe", + "Msbuild.exe", "Msconfig.exe", "Msdt.exe", "Msiexec.exe", "Netsh.exe", + "Odbcconf.exe", "OfflineScannerShell.exe", "Pcalua.exe", "Pcwrun.exe", + "Pnputil.exe", "PresentationHost.exe", "Rasautou.exe", "Regasm.exe", + "Register-cimprovider.exe", "Regsvcs.exe", "Regsvr32.exe", "Runonce.exe", + "Runscripthelper.exe", "Schtasks.exe", "Scriptrunner.exe", "SettingSyncHost.exe", + "Stordiag.exe", "Syncappvpublishingserver.exe", "Ttdinject.exe", "Mshta.exe", + "Tttracer.exe", "Verclsid.exe", "Wab.exe", "Wmic.exe", + "WorkFolders.exe", "Wuauclt.exe", "Xwizard.exe" + ) + NOT ( + Processes.parent_process IN ("*-k GPSvcGroup*", "*-k netsvcs", "*-k netsvcs -p","*-k netsvcs -p -s gpsvc") + Processes.process_name = "Gpscript.exe" + ) + NOT ( + Processes.parent_process IN ("*-k netsvcs", "*-k netsvcs -p", "*-k netsvcs -p -s wuauserv", "-k netsvcs -p -s Schedule") + Processes.process_name IN ("Wuauclt.exe", "Schedule.exe") + ) + NOT ( + Processes.parent_process = "*-k DcomLaunch*" + Processes.process_name IN ("PresentationHost.exe", "SettingSyncHost.exe") + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -44,11 +76,16 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Svchost.exe spawned a LOLBAS process on $dest$ + title: The parent process[$parent_process$] spawned a Living Off The Land process [$process_name$] on [$dest$] entity: field: dest type: system score: 50 +threat_objects: + - field: parent_process + type: process + - field: process_name + type: process_name analytic_story: - Active Directory Lateral Movement - Living Off The Land diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index cae5be714b..0d63144d23 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -1,15 +1,43 @@ name: Time Provider Persistence Registry id: 5ba382c4-2105-11ec-8d8f-acde48001122 -version: 15 +version: 16 creation_date: '2021-09-29' -modification_date: '2026-05-13' +modification_date: '2026-07-08' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects suspicious modifications to the time provider registry for persistence and autostart. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CurrentControlSet\\Services\\W32Time\\TimeProviders" registry path. This activity is significant because such modifications are uncommon and can indicate an attempt to establish persistence on a compromised host. If confirmed malicious, this technique allows an attacker to maintain access and execute code automatically upon system boot, potentially leading to further exploitation and control over the affected system. +description: |- + The following analytic detects suspicious modifications to the time provider registry for persistence and autostart. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CurrentControlSet\\Services\\W32Time\\TimeProviders" registry path. + This activity is significant because such modifications are uncommon and can indicate an attempt to establish persistence on a compromised host. + If confirmed malicious, this technique allows an attacker to maintain access and execute code automatically upon system boot, potentially leading to further exploitation and control over the affected system. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `time_provider_persistence_registry_filter`' +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Registry WHERE + + Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\*" + Registry.registry_value_name = "DllName" + NOT Registry.registry_value_data IN + ( + "%SystemRoot%\System32\vmictimeprovider.dll", + "%SystemRoot%\System32\w32time.dll", + "C:\\Windows\\System32\\vmictimeprovider.dll", + "C:\\Windows\\System32\\w32time.dll" + ) + + by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `time_provider_persistence_registry_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_appcertdll_modification_via_command_line.yml b/detections/endpoint/windows_appcertdll_modification_via_command_line.yml index 6f0c70a235..7a31021714 100644 --- a/detections/endpoint/windows_appcertdll_modification_via_command_line.yml +++ b/detections/endpoint/windows_appcertdll_modification_via_command_line.yml @@ -2,7 +2,7 @@ name: Windows AppCertDLL Modification Via Command Line id: 3ba73a2b-3396-47e4-bdef-c80e6a7895c0 version: 2 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Raven Tait, Splunk status: production type: Anomaly @@ -40,6 +40,8 @@ search: |- how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: |- Modifications to AppCertDLL keys may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources. +references: + - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ diff --git a/detections/endpoint/windows_appcertdll_modification_via_registry.yml b/detections/endpoint/windows_appcertdll_modification_via_registry.yml new file mode 100644 index 0000000000..28aeaf306a --- /dev/null +++ b/detections/endpoint/windows_appcertdll_modification_via_registry.yml @@ -0,0 +1,80 @@ +name: Windows AppCertDLL Modification Via Registry +id: 547d98dd-6d6e-4aa4-be91-a1a119f48df3 +version: 1 +creation_date: '2026-07-27' +modification_date: '2026-07-27' +author: Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + This analytic detects attempts to modify AppCertDLL registry entries. + Values under this registry entry are used to specify DLLs loaded by the Windows Session Manager. + Such modifications can be abused by attackers to load malicious code early in the system startup process, enabling persistent malware execution with high privileges. + If confirmed malicious, this behavior may lead to system compromise, persistence, and the evasion of security controls. +data_source: + - Sysmon EventID 13 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Registry WHERE + + Registry.action = "modified" + Registry.registry_path= "*\\Control\\Session Manager\\AppCertDLLs\\*" + Registry.registry_value_data = "*" + + by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status + Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_appcertdll_modification_via_registry_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 +known_false_positives: |- + Modifications to AppCertDLL entries may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources. +references: + - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential AppCertDLL modification with value [$registry_value_data$] activity observed on [$dest$] +threat_objects: + - field: registry_value_data + type: registry_value_text +analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1546.009 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.009/snapattack/registry.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 1a9ee0ad8d..d17aeac465 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -124,5 +124,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index fcb05ae216..6b6034e879 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -1,18 +1,51 @@ name: Windows Curl Upload to Remote Destination id: 42f8f1a2-4228-11ec-aade-acde48001122 -version: 17 +version: 18 creation_date: '2021-11-10' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the use of Windows Curl.exe to upload a file to a remote destination. It identifies command-line arguments such as `-T`, `--upload-file`, `-d`, `--data`, and `-F` in process execution logs. This activity is significant because adversaries may use Curl to exfiltrate data or upload malicious payloads. If confirmed malicious, this could lead to data breaches or further compromise of the system. Analysts should review parallel processes and network logs to determine if the upload was successful and isolate the endpoint if necessary. +description: |- + The following analytic detects the use of Windows Curl.exe to upload a file to a remote destination. + It identifies command-line arguments such as `-T`, `--upload-file`, `-d`, `--data`, and `-F` in process execution logs. + This activity is significant because adversaries may use Curl to exfiltrate data or upload malicious payloads. If confirmed malicious, this could lead to data breaches or further compromise of the system. + Analysts should review parallel processes and network logs to determine if the upload was successful and isolate the endpoint if necessary. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 - Cisco Network Visibility Module Flow Data -search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\nas lastTime from datamodel=Endpoint.Processes where\n(Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe)\nProcesses.process IN (\n \"*-T *\",\n \"*--upload-file *\",\n \"*-d *\",\n \"*--data *\",\n \"*-F *\"\n)\nby Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec\n Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path\n Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id\n Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id\n Processes.vendor_product\n| `drop_dm_object_name(Processes)`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `windows_curl_upload_to_remote_destination_filter`\n" +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + ( + Processes.process_name=curl.exe + OR + Processes.original_file_name=Curl.exe + ) + Processes.process IN ( + "*-T *", + "*--upload-file *", + "*-d *", + "*--data *", + "*-F *" + ) + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_curl_upload_to_remote_destination_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: False positives may be limited to source control applications and may be required to be filtered out. references: @@ -73,5 +106,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml index f2d30f8e3f..b8105a3497 100644 --- a/detections/endpoint/windows_file_download_via_certutil.yml +++ b/detections/endpoint/windows_file_download_via_certutil.yml @@ -2,7 +2,7 @@ name: Windows File Download Via CertUtil id: 7fac8d40-e370-45ea-a4a3-031bbcc18b02 version: 7 creation_date: '2021-03-24' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP @@ -97,5 +97,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_file_download_via_powershell.yml b/detections/endpoint/windows_file_download_via_powershell.yml index 0b1fc1c023..72f19c64fe 100644 --- a/detections/endpoint/windows_file_download_via_powershell.yml +++ b/detections/endpoint/windows_file_download_via_powershell.yml @@ -2,7 +2,7 @@ name: Windows File Download Via PowerShell id: 58c4e56c-b5b8-46a3-b5fb-6537dca3c6de version: 10 creation_date: '2021-03-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -108,5 +108,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index 2c53140f8d..d6efe846e6 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -1,21 +1,43 @@ name: Windows File Without Extension In Critical Folder id: 0dbcac64-963c-11ec-bf04-acde48001122 -version: 12 +version: 13 creation_date: '2022-02-25' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Teoderick Contreras, Bhavin Patel, Splunk status: production -type: TTP -description: This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, Windows\WinSxS, and other known Windows driver storage and loading paths. The detection has been expanded to comprehensively cover all commonly abused and legitimate Windows driver folder locations, increasing visibility into attempts to stage or deploy kernel-mode components. The analytic leverages telemetry from the Endpoint.Filesystem data model, with a focus on file creation events and file path analysis. File creation activity in these directories—particularly involving extensionless files—is highly suspicious, as it may indicate the presence of destructive or stealthy malware. This behavior is consistent with malware families such as HermeticWiper, which deploy kernel driver components into trusted Windows driver directories to obtain low-level access and execute destructive payloads. If confirmed malicious, this activity can result in severe system compromise, including the deployment of malicious drivers, boot-sector or filesystem destruction, and ultimately system inoperability and irreversible data loss. +type: Anomaly +description: |- + This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, Windows\WinSxS, and other known Windows driver storage and loading paths. + The analytic leverages telemetry from the Endpoint.Filesystem data model, with a focus on file creation events and file path analysis. + File creation activity in these directories—particularly involving extensionless files—is highly suspicious, as it may indicate the presence of destructive or stealthy malware. + This behavior is consistent with malware families such as HermeticWiper, which deploy kernel driver components into trusted Windows driver directories to obtain low-level access and execute destructive payloads. + If confirmed malicious, this activity can result in severe system compromise, including the deployment of malicious drivers, boot-sector or filesystem destruction, and ultimately system inoperability and irreversible data loss. data_source: - Sysmon EventID 11 search: | - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path IN("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*", "*\\WINDOWS\\inf\\*","*\\Program Files*", "*\\WINDOWS\\System32\\DriverStore\\*","*:\\Windows\\WinSxS\\*","*\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*","*\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*","*\\Windows\\servicing\\*", "*\\Windows\\ELAMBKUP\\*","*\\Windows\\Boot\\*","*\\System32\\Boot\\*","*\\System32\\Recovery\\*", "C:\\AMD\\*", "C:\\OEM\\*") + | tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created", "modified") + Filesystem.file_path IN( + "*:\\AMD\\*", + "*:\\OEM\\*", + "*:\\Windows\\Boot\\*", + "*:\\Windows\\ELAMBKUP\\*", + "*:\\Windows\\INF\\*", + "*:\\Windows\\servicing\\*", + "*:\\Windows\\System32\\Boot\\*", + "*:\\Windows\\System32\\Drivers\\*", + "*:\\Windows\\System32\\DriverStore\\*", + "*:\\Windows\\System32\\Recovery\\*", + "*:\\Windows\\SysWOW64\\Drivers\\*" + ) + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | rex field="file_name" "\.(?<extension>[^\.]*$)" | where isnull(extension) @@ -23,7 +45,8 @@ search: | | `security_content_ctime(lastTime)` | `windows_file_without_extension_in_critical_folder_filter` how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: No false positives have been identified at this time. +known_false_positives: |- + If you are leveraging Sysmon, you may see false positives related to folder creation, since Event ID 11 does not contain enough information to determine if the file is a File or a Directory. Filter out those entries when leveraging this analytic. references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html - https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html @@ -37,12 +60,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Driver file with out file extension drop in $file_path$ on $dest$ - entity: - field: user - type: user - score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 20 + message: A file without extension [$file_name$] was dropped in a critical folder [$file_path$] by $user$ threat_objects: - field: file_name type: file_name diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index b9370a8269..b9c1505e46 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -2,7 +2,7 @@ name: Windows HTTP Network Communication From MSIExec id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 version: 11 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: Anomaly @@ -109,5 +109,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index e1236510bb..3b37e24b84 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 version: 19 creation_date: '2021-11-12' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: Anomaly @@ -96,5 +96,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index 990d9030c9..144f09ad86 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil URL in Command Line id: 28e06670-43df-11ec-a569-acde48001122 version: 15 creation_date: '2021-11-12' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP @@ -82,5 +82,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml index f272f56cef..f056478f50 100644 --- a/detections/endpoint/windows_kerberos_local_successful_logon.yml +++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml @@ -1,29 +1,49 @@ name: Windows Kerberos Local Successful Logon id: 8309c3a8-4d34-48ae-ad66-631658214653 -version: 14 +version: 15 creation_date: '2022-04-28' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account. This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise. +description: |- + The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. + It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account. + This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges. + If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise. data_source: - Windows Event Log Security 4624 search: |- - `wineventlog_security` EventCode=4624 LogonType=3 AuthenticationPackageName=Kerberos action=success src=127.0.0.1 - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY action app authentication_method - dest dvc process - process_id process_name process_path - signature signature_id src - src_port status subject - user user_group vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_kerberos_local_successful_logon_filter` -how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required. -known_false_positives: False positives are possible, filtering may be required to restrict to workstations vs domain controllers. Filter as needed. + `wineventlog_security` + EventCode=4624 + LogonType=3 + AuthenticationPackageName=Kerberos + action=success + src=127.0.0.1 + + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + BY action app authentication_method + dest dvc process + process_id process_name process_path + signature signature_id src + src_port status subject + user user_group vendor_product + + | lookup update=true domain_controllers sAMAccountName as dest OUTPUT isDC + | where isnull(isDC) + | fields - isDC + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_kerberos_local_successful_logon_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required. + Populate the `domain_controllers` lookup with the hostnames that appear in the `dest` field for domain controllers in your environment. +known_false_positives: |- + False positives are possible, particularly from domain controllers that use Kerberos SSP and loopback authentication. + Add known domain controllers to the `domain_controllers` lookup to suppress those results. Filter as needed. references: - https://github.com/Dec0ne/KrbRelayUp drilldown_searches: diff --git a/detections/endpoint/windows_local_llm_framework_execution.yml b/detections/endpoint/windows_local_llm_framework_execution.yml index 4b89d908af..3eb169770d 100644 --- a/detections/endpoint/windows_local_llm_framework_execution.yml +++ b/detections/endpoint/windows_local_llm_framework_execution.yml @@ -1,9 +1,9 @@ name: Windows Local LLM Framework Execution id: a3f8e2c9-7d4b-4e1f-9c6a-2b5d8f3e1a7c -version: 2 +version: 3 creation_date: '2025-11-24' -modification_date: '2026-05-13' -author: Rod Soto, Splunk +modification_date: '2026-07-15' +author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Hunting description: | @@ -37,13 +37,13 @@ search: | ) OR Processes.original_file_name IN ( - "ollama.exe", - "lmstudio.exe", "gpt4all.exe", "jan.exe", - "llama-run.exe", "koboldcpp.exe", - "nutstudio.exe" + "llama-run.exe", + "lmstudio.exe", + "nutstudio.exe", + "ollama.exe" ) OR Processes.process IN ( @@ -75,6 +75,20 @@ search: | "text-generation-webui.exe" ) ) + NOT Processes.process_name IN ( + "360se.exe", "Acrobat.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", + "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe", + "chrome.exe", "chromium.exe", "coccoc.exe", "comet.exe", "conhost.exe", + "dragon.exe", "duckduckgo.exe", "epic.exe", "EXCEL.EXE", "firefox.exe", + "FoxitPDFReader.exe", "ghost.exe", "iexplore.exe", "iridium.exe", "iron.exe", + "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe", + "msedgewebview2.exe", "mspaint.exe", "NewformaOCR.exe", "notepad.exe", + "opera_autoupdate.exe", "opera.exe", "OUTLOOK.EXE", "perplexity.exe", + "Photos.exe", "POWERPNT.EXE", "rave.exe", "Revu.exe", "safari.exe", + "shift.exe", "sidekick.exe", "Stapler.exe", "thorium.exe", "torch.exe", + "vivaldi.exe", "wavebrowser.exe", "whale.exe", "WINWORD.EXE", "zen.exe" + ) + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process diff --git a/detections/endpoint/windows_mark_of_the_web_bypass.yml b/detections/endpoint/windows_mark_of_the_web_bypass.yml index 6a8b4928ae..e4ab37c13d 100644 --- a/detections/endpoint/windows_mark_of_the_web_bypass.yml +++ b/detections/endpoint/windows_mark_of_the_web_bypass.yml @@ -1,26 +1,30 @@ name: Windows Mark Of The Web Bypass id: 8ca13343-7405-4916-a2d1-ae34ce0c28ae -version: 12 +version: 13 creation_date: '2023-08-14' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic identifies a suspicious process that deletes the Mark-of-the-Web (MOTW) data stream. It leverages Sysmon EventCode 23 to detect when a file's Zone.Identifier stream is removed. This activity is significant because it is a common technique used by malware, such as Ave Maria RAT, to bypass security restrictions on files downloaded from the internet. If confirmed malicious, this behavior could allow an attacker to execute potentially harmful files without triggering security warnings, leading to further compromise of the system. data_source: - Sysmon EventID 23 + - Sysmon EventID 26 search: |- - `sysmon` EventCode=23 TargetFilename = "*:Zone.Identifier" - | stats count min(_time) as firstTime, max(_time) as lastTime - BY action dest dvc - file_path file_hash file_name - file_modify_time process_exec process_guid - process_id process_name process_path - signature signature_id user - user_id vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_mark_of_the_web_bypass_filter` + `sysmon` + EventCode IN (23, 26) + TargetFilename = "*:Zone.Identifier" + | stats count min(_time) as firstTime + max(_time) as lastTime + BY action dest dvc file_path + file_hash file_name + file_modify_time process_exec process_guid + process_id process_name process_path + signature signature_id user + user_id vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_mark_of_the_web_bypass_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the deleted target file name, process name and process id from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml b/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml index ca74e68602..f02724f4c2 100644 --- a/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml +++ b/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml @@ -1,8 +1,8 @@ name: Windows MSI Rollback Script Deleted By Non-Msiexec Process id: 6ec7cbda-9547-4f6b-8a00-d1fb4b52c1e9 -version: 2 +version: 3 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Raven Tait, Splunk status: production type: TTP @@ -13,9 +13,10 @@ description: |- The folder is protected with a strong DACL specifically to prevent tampering by low-privileged users — because whatever is in these files will be executed by the SYSTEM-level Installer service during rollback. data_source: - Sysmon EventID 23 + - Sysmon EventID 26 search: |- `sysmon` - EventID=23 + EventCode IN (23, 26) TargetFilename="*:\\Config.Msi\\*" TargetFilename="*.rbs" NOT ProcessName="msiexec.exe" diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index 26ae59b55a..b6fc68b795 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -2,7 +2,7 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda version: 17 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: Anomaly @@ -98,5 +98,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml b/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml index 1a1edbc223..c6b1440c9b 100644 --- a/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml +++ b/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml @@ -2,7 +2,7 @@ name: Windows PowerShell FakeCAPTCHA Clipboard Execution id: d81d4d3d-76b5-4f21-ab51-b17d5164c106 version: 9 creation_date: '2025-05-19' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP @@ -99,5 +99,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index 7237ee14b2..236b6b47f3 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -1,19 +1,58 @@ name: Windows Process With NamedPipe CommandLine id: e64399d4-94a8-11ec-a9da-acde48001122 -version: 9 +version: 10 creation_date: '2022-02-23' -modification_date: '2026-05-13' +modification_date: '2026-07-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects processes with command lines containing named pipes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions. This behavior is significant as it is often used by adversaries, such as those behind the Olympic Destroyer malware, for inter-process communication post-injection, aiding in defense evasion and privilege escalation. If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system. +description: |- + The following analytic detects processes with command lines containing named pipes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions. + This behavior is significant as it is often used by adversaries, such as those behind the Olympic Destroyer malware, for inter-process communication post-injection, aiding in defense evasion and privilege escalation. + If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\\\.\\pipe\\*" NOT Processes.process_path IN ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Normal browser application may use this technique. Please update the filter macros to remove false positives. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process = "*\\\\.\\pipe\\*" + ( + NOT Processes.parent_process_path IN ( + "*:\\Program Files (x86)\\*", + "*:\\Program Files\\*", + "*:\\Windows\\System32\\*", + "*:\\Windows\\SysWOW64\\*" + ) + OR + NOT Processes.process_path IN ( + "*:\\Program Files (x86)\\*", + "*:\\Program Files\\*", + "*:\\Windows\\System32\\*", + "*:\\Windows\\SysWOW64\\*" + ) + ) + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process + Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_with_namedpipe_commandline_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Normal browser application may use this technique. Please update the filter macros to remove false positives. references: - https://blog.talosintelligence.com/2018/02/olympic-destroyer.html drilldown_searches: @@ -30,7 +69,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Process with named pipe in $process$ on $dest$ + message: The parent process $parent_process$ spawned a process with the CommandLine $process$ that contains a named pipe on $dest$ analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint diff --git a/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml b/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml index 960c884be4..4b12531499 100644 --- a/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml +++ b/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml @@ -1,8 +1,8 @@ name: Windows Rdp AutomaticDestinations Deletion id: e40a40a1-9fea-4554-abdf-b164422f0627 -version: 4 +version: 5 creation_date: '2025-08-06' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -10,7 +10,21 @@ description: This detection identifies the deletion of files within the Automati data_source: - Sysmon EventID 23 - Sysmon EventID 26 -search: '`sysmon` EventCode=23 TargetFilename IN ("*\\Recent\\AutomaticDestinations*") | stats count min(_time) as firstTime, max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_automaticdestinations_deletion_filter`' +search: |- + `sysmon` + EventCode IN (23, 26) + TargetFilename IN ("*\\Recent\\AutomaticDestinations*") + | stats count min(_time) as firstTime + max(_time) as lastTime + + by action dest dvc file_path file_hash file_name + file_modify_time process_exec process_guid process_id + process_name process_path signature + signature_id user user_id vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_rdp_automaticdestinations_deletion_filter` how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed. known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter. references: diff --git a/detections/endpoint/windows_rdp_cache_file_deletion.yml b/detections/endpoint/windows_rdp_cache_file_deletion.yml index e08eb6d699..dff11ef0e7 100644 --- a/detections/endpoint/windows_rdp_cache_file_deletion.yml +++ b/detections/endpoint/windows_rdp_cache_file_deletion.yml @@ -1,16 +1,38 @@ name: Windows RDP Cache File Deletion id: f3e86ff3-b1f9-4382-8924-6913385f1019 -version: 4 +version: 5 creation_date: '2025-08-06' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: This detection identifies the deletion of RDP bitmap cache files—specifically .bmc and .bin files—typically stored in the user profile under the Terminal Server Client\Cache directory. These files are created by the native Windows Remote Desktop Client (mstsc.exe) and store graphical elements from remote sessions to improve performance. Deleting these files may indicate an attempt to remove forensic evidence of RDP usage. While rare in legitimate user behavior, this action is commonly associated with defense evasion techniques used by attackers or red teamers who wish to hide traces of interactive remote access. When observed in conjunction with recent logon activity, RDP session indicators, or script execution, this behavior should be treated as potentially malicious. Monitoring for deletion of these files provides valuable visibility into anti-forensic actions that often follow lateral movement or hands-on-keyboard activity. +description: |- + This detection identifies the deletion of RDP bitmap cache files—specifically .bmc and .bin files—typically stored in the user profile under the Terminal Server Client\Cache directory. + These files are created by the native Windows Remote Desktop Client (mstsc.exe) and store graphical elements from remote sessions to improve performance. + Deleting these files may indicate an attempt to remove forensic evidence of RDP usage. + While rare in legitimate user behavior, this action is commonly associated with defense evasion techniques used by attackers or red teamers who wish to hide traces of interactive remote access. + When observed in conjunction with recent logon activity, RDP session indicators, or script execution, this behavior should be treated as potentially malicious. Monitoring for deletion of these files provides valuable visibility into anti-forensic actions that often follow lateral movement or hands-on-keyboard activity. data_source: - Sysmon EventID 23 - Sysmon EventID 26 -search: '`sysmon` EventCode IN ("23", "26") TargetFilename IN ("*\\Terminal Server Client\\Cache\\*.bmc", "*\\Terminal Server Client\\Cache\\cache*.bin") | stats count min(_time) as firstTime, max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_cache_file_deletion_filter`' +search: |- + `sysmon` + EventCode IN (23, 26) + TargetFilename IN ( + "*\\Terminal Server Client\\Cache\\*.bmc", + "*\\Terminal Server Client\\Cache\\cache*.bin" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + + by action dest dvc file_path file_hash file_name + file_modify_time process_exec process_guid process_id + process_name process_path signature + signature_id user user_id vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_rdp_cache_file_deletion_filter` how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed. known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter. references: diff --git a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml index aaf60e32cd..2dbde3a76f 100644 --- a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml +++ b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Defender Update Activity in INetCache id: 3e25f906-6319-44ad-ab9a-22d162eb3925 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-07-20' author: Raven Tait, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ data_source: - Sysmon EventID 23 search: |- `sysmon` - EventID IN ("11","23") + EventID IN (11, 23, 26) TargetFilename="*\\INetCache*" TargetFilename="*\\mpam-fe[1].exe*" NOT Image IN ( diff --git a/detections/endpoint/windows_winscp_configuration_security_access.yml b/detections/endpoint/windows_winscp_configuration_security_access.yml index 14e78754bc..5e11ead6c8 100644 --- a/detections/endpoint/windows_winscp_configuration_security_access.yml +++ b/detections/endpoint/windows_winscp_configuration_security_access.yml @@ -1,8 +1,8 @@ name: Windows WinSCP Configuration Security Access id: 90013cc4-585b-4437-a95f-099933974f3e -version: 1 +version: 2 creation_date: '2026-06-24' -modification_date: '2026-06-24' +modification_date: '2026-07-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -17,7 +17,7 @@ search: |- `wineventlog_security` EventCode=4663 object_file_path="*\\Martin Prikryl\\WinSCP 2\\Configuration\\Security*" - NOT process_name IN ("winscp.exe") + NOT process_path IN ("*:\\Program Files (x86)\\WinSCP\\WinSCP.exe") | stats count min(_time) as firstTime max(_time) as lastTime @@ -32,7 +32,7 @@ how_to_implement: |- To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." known_false_positives: |- - False positive may occur during backup or anti-virus scanning process. Filter as needed. + False positive may occur during backup or anti-virus scanning process, as well as from WinSCP itself if it is installed in a different path than the default path. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.phantom_stealer - https://www.proofpoint.com/us/blog/threat-insight/not-safe-work-tracking-and-investigating-stealerium-and-phantom-infostealers diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 5a613d7bc2..62ae6bd88a 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -2,7 +2,7 @@ name: WMIC XSL Execution via URL id: 787e9dd0-4328-11ec-a029-acde48001122 version: 14 creation_date: '2021-11-12' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP @@ -103,5 +103,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/lookups/csv/domain_controllers.csv b/lookups/csv/domain_controllers.csv new file mode 100644 index 0000000000..8fa743818b --- /dev/null +++ b/lookups/csv/domain_controllers.csv @@ -0,0 +1,2 @@ +sAMAccountName,isDC +dc01.example.com,true diff --git a/lookups/csv/domain_controllers.yml b/lookups/csv/domain_controllers.yml new file mode 100644 index 0000000000..dd6b054aec --- /dev/null +++ b/lookups/csv/domain_controllers.yml @@ -0,0 +1,9 @@ +name: domain_controllers +id: f9983e0d-0201-40c1-babe-8b66b2cf963d +version: 1 +creation_date: '2026-07-27' +modification_date: '2026-07-27' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of domain controller hostnames used to filter known domain controllers. +case_sensitive_match: false diff --git a/lookups/csv/ransomware_notes_lookup.csv b/lookups/csv/ransomware_notes_lookup.csv index be84e2dbd8..a92a6a5307 100644 --- a/lookups/csv/ransomware_notes_lookup.csv +++ b/lookups/csv/ransomware_notes_lookup.csv @@ -69,7 +69,6 @@ MILIHPEN-INSTRUCT.txt,True GANGBANG-NOTE.txt,True GET_YOUR_FILES_BACK.txt,True read_it.txt,True -*.README.txt, True *READ_ME_MEDUSA*.TXT,True How_to_back_files.HTML,True CriticalBreachDetected.pdf,True diff --git a/lookups/csv/ransomware_notes_lookup.yml b/lookups/csv/ransomware_notes_lookup.yml index 0de6c22f19..9fcc5ac27a 100644 --- a/lookups/csv/ransomware_notes_lookup.yml +++ b/lookups/csv/ransomware_notes_lookup.yml @@ -1,8 +1,8 @@ name: ransomware_notes_lookup id: 93d9fb06-035e-496c-91d5-7a79543ce1e1 -version: 5 +version: 6 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-07-02' author: Splunk Threat Research Team lookup_type: csv description: A list of file names that are ransomware note files diff --git a/macros/cisco_network_visibility_module_flowdata.yml b/macros/cisco_network_visibility_module_flowdata.yml index 800640357e..2bd734e8d1 100644 --- a/macros/cisco_network_visibility_module_flowdata.yml +++ b/macros/cisco_network_visibility_module_flowdata.yml @@ -1,8 +1,8 @@ name: cisco_network_visibility_module_flowdata id: f6c50d56-4ae1-4dd3-b265-d2b00f9e3eb4 -version: 1 +version: 2 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Splunk Threat Research Team description: customer specific splunk configurations(eg- index, source, sourcetype) for Cisco Network Visibility Module flow logs. Replace the macro definition with configurations for your Splunk Environment. -definition: sourcetype="cisco:nvm:flowdata" +definition: sourcetype IN ("cisco:nvm:flowdata", "cisco:nvm:flowdata:v2") From 345f42f5ac86acd8c4bcba3c38e69c705df7f20b Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Mon, 27 Jul 2026 21:51:33 +0200 Subject: [PATCH 047/164] Fix Issues (#4182) --- .github/workflows/unit-testing.yml | 3 ++- detections/endpoint/linux_apparmor_bypass_via_aaexec.yml | 2 +- .../endpoint/svchost_lolbas_execution_process_spawn.yml | 2 +- detections/endpoint/time_provider_persistence_registry.yml | 4 ++-- 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index c15bbc1aa3..ad8abf2dda 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -3,10 +3,11 @@ on: pull_request: types: [opened, reopened, synchronize] paths: - - detections/** - data_sources/** + - detections/** - lookups/** - macros/** + - install.yml jobs: unit-testing: runs-on: large-ubuntu-22.04-32core diff --git a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml index 21c54d3be5..a4c7203510 100644 --- a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml +++ b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml @@ -16,7 +16,7 @@ search: |- AND Processes.process="* -p *" AND Processes.process="*--*" AND Processes.process IN ("*trinity*","*chrome*","*flatpak*") - AND NOT Processes.process_name IN ("/user*","/opt*","/snap*","/var/lib/flatpak*") + AND NOT Processes.process_path IN ("/user*","/opt*","/snap*","/var/lib/flatpak*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index 02c80f9149..2d1937a88b 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -41,7 +41,7 @@ search: |- ) NOT ( Processes.parent_process IN ("*-k netsvcs", "*-k netsvcs -p", "*-k netsvcs -p -s wuauserv", "-k netsvcs -p -s Schedule") - Processes.process_name IN ("Wuauclt.exe", "Schedule.exe") + Processes.process_name IN ("Wuauclt.exe", "Schtasks.exe") ) NOT ( Processes.parent_process = "*-k DcomLaunch*" diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 0d63144d23..2510d5a640 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -23,8 +23,8 @@ search: |- Registry.registry_value_name = "DllName" NOT Registry.registry_value_data IN ( - "%SystemRoot%\System32\vmictimeprovider.dll", - "%SystemRoot%\System32\w32time.dll", + "%SystemRoot%\\System32\\vmictimeprovider.dll", + "%SystemRoot%\\System32\\w32time.dll", "C:\\Windows\\System32\\vmictimeprovider.dll", "C:\\Windows\\System32\\w32time.dll" ) From dfcad81abae066a47c20a1cfdef35be27cde0a66 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Mon, 27 Jul 2026 15:17:52 -0700 Subject: [PATCH 048/164] updating based on Nas' comment (#4183) --- detections/endpoint/linux_apparmor_bypass_via_aaexec.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml index a4c7203510..903cb6d04e 100644 --- a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml +++ b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml @@ -16,7 +16,7 @@ search: |- AND Processes.process="* -p *" AND Processes.process="*--*" AND Processes.process IN ("*trinity*","*chrome*","*flatpak*") - AND NOT Processes.process_path IN ("/user*","/opt*","/snap*","/var/lib/flatpak*") + AND NOT Processes.process IN ("/user*","/opt*","/snap*","/var/lib/flatpak*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id From a79a08f073c1330309f3c0e16ea6ce6e0f41a221 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Mon, 27 Jul 2026 15:19:32 -0700 Subject: [PATCH 049/164] removing dashbaord due to VULN (#4184) --- dashboards/threat_activity_by_snort_ids.json | 963 ------------------- dashboards/threat_activity_by_snort_ids.yml | 7 - 2 files changed, 970 deletions(-) delete mode 100644 dashboards/threat_activity_by_snort_ids.json delete mode 100644 dashboards/threat_activity_by_snort_ids.yml diff --git a/dashboards/threat_activity_by_snort_ids.json b/dashboards/threat_activity_by_snort_ids.json deleted file mode 100644 index b872568e9d..0000000000 --- a/dashboards/threat_activity_by_snort_ids.json +++ /dev/null @@ -1,963 +0,0 @@ -{ - "title": "Threat Activity by Snort IDs", - "description": "Use this dashboard to explore how Snort signatures correlate with specific threats and surfaces broader device activity. It’s organized into four tabs:", - "inputs": { - "input_global_trp": { - "options": { - "defaultValue": "-24h@h,now", - "token": "global_time" - }, - "title": "Global Time Range", - "type": "input.timerange" - }, - "input_tlWhhLwR": { - "containerOptions": { - "visibility": { - "hideWhenNoData": true - } - }, - "context": { - "formattedConfig": { - "number": { - "prefix": "" - } - }, - "formattedStatics": ">statics | formatByType(formattedConfig)", - "label": ">primary | seriesByName(\"threat\") | renameSeries(\"label\") | formatByType(formattedConfig)", - "statics": [], - "value": ">primary | seriesByName(\"threat\") | renameSeries(\"value\") | formatByType(formattedConfig)" - }, - "dataSources": { - "primary": "ds_i58D84BP" - }, - "options": { - "defaultValue": "Select a threat", - "items": ">frame(label, value) | prepend(formattedStatics) | objects()", - "token": "threat_token" - }, - "title": "Threat", - "type": "input.dropdown" - } - }, - "defaults": { - "dataSources": { - "ds.search": { - "options": { - "queryParameters": { - "earliest": "$global_time.earliest$", - "latest": "$global_time.latest$" - } - } - } - } - }, - "visualizations": { - "viz_1ZFeC3zY": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_m3IAfEaF" - }, - "description": "This table shows a detailed view of the snort events matched with the threat", - "eventHandlers": [ - { - "options": { - "tabId": "layout_hEVylosH" - }, - "type": "drilldown.switchToTab" - } - ], - "showLastUpdated": false, - "showProgressBar": false, - "title": "Snort Intrusion Events for - $threat_token$", - "type": "splunk.table" - }, - "viz_3VU4OAeI": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_fwElVms9" - }, - "description": "This table shows how many distinct source IPs hit each day.", - "options": { - "backgroundColor": "transparent", - "seriesColors": [ - "#7B56DB", - "#009CEB", - "#62b3b2", - "#DD9900", - "#FF677B", - "#CB2196", - "#813193", - "#0051B5", - "#008C80", - "#99B100", - "#FFA476", - "#FF6ACE", - "#AE8CFF", - "#00689D", - "#00490A", - "#465D00", - "#9D6300", - "#F6540B", - "#FF969E", - "#E47BFE" - ] - }, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Unique Attackers per Day", - "type": "splunk.column" - }, - "viz_70gtzPTV": { - "options": { - "backgroundColor": "#ffffff", - "fontColor": "#0877a6", - "fontSize": "large", - "markdown": "### Timeline\n\n- Visualizes the daily activity related to all Snort signature \n\n- Tracks total intrusion attempts per the selected time range\n- Highlights frequency and consistency of threat activity over time" - }, - "type": "splunk.markdown" - }, - "viz_8VIu1U0s": { - "containerOptions": {}, - "context": {}, - "dataSources": { - "primary": "ds_8LU6nawL" - }, - "description": "This table gives you an overview of all active threat actors in your environment", - "options": {}, - "showLastUpdated": false, - "showProgressBar": false, - "title": "All Intrusion Events by Threat Actor", - "type": "splunk.pie" - }, - "viz_AQzurdgj": { - "containerOptions": {}, - "context": { - "majorColorEditorConfig": [ - { - "to": 20, - "value": "#ffffff" - }, - { - "from": 20, - "to": 40, - "value": "#669922" - }, - { - "from": 40, - "to": 80, - "value": "#cba700" - }, - { - "from": 80, - "value": "#d41f1f" - } - ], - "trendColorEditorConfig": [ - { - "to": 0, - "value": "#9E2520" - }, - { - "from": 0, - "value": "#1C6B2D" - } - ] - }, - "dataSources": { - "primary": "ds_cU42yLz2" - }, - "description": "This table shows the file events per day", - "options": {}, - "showLastUpdated": false, - "showProgressBar": false, - "title": "File Events Trend", - "type": "splunk.area" - }, - "viz_FY6hwnml": { - "dataSources": { - "primary": "ds_wzZtYKW7" - }, - "description": "Shows the IP address currently being investigated", - "title": "Investigating IP", - "type": "splunk.singlevalue" - }, - "viz_ISoX6BgF": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_z10zC280" - }, - "description": "This table shows all the various file_events on $dest_ip$", - "showLastUpdated": false, - "showProgressBar": false, - "title": "File Events on $dest_ip$", - "type": "splunk.events" - }, - "viz_KQjoxczF": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_PpNvhTDF" - }, - "description": "This shows the distinct number of snort signatures matched for this threat", - "showLastUpdated": false, - "showProgressBar": false, - "title": "Distinct Snort Signature Hits", - "type": "splunk.singlevalue" - }, - "viz_NT8j5Ogy": { - "dataSources": { - "primary": "ds_ta3O0H2Z" - }, - "options": { - "center": [ - 45.503975321779336, - -48.221416265989774 - ], - "zoom": 1.6208701026526793 - }, - "title": "Connection Events", - "type": "splunk.map" - }, - "viz_SnsguT0c": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_f4HzVHsa" - }, - "description": "This is the description of the selected threat actor - $threat_token$", - "options": { - "fontSize": "large", - "headerVisibility": "fixed" - }, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Threat Desciption", - "type": "splunk.table" - }, - "viz_T6i68u8y": { - "containerOptions": {}, - "context": {}, - "dataSources": { - "primary": "ds_QAFOBzEx" - }, - "options": {}, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Volume Inbound", - "type": "splunk.singlevalue" - }, - "viz_VpTFMowK": { - "containerOptions": {}, - "context": { - "Search_NameColumnFormatEditorConfig": { - "string": { - "unitPosition": "after" - } - } - }, - "dataSources": { - "primary": "ds_0SEcxnrn" - }, - "description": "List of related risk events in Enterprise Security for the affected host - $dest_ip$", - "eventHandlers": [ - { - "options": { - "app": "CiscoSecurityCloud", - "newTab": true, - "report": "Risk - Risk Modifiers Over Time" - }, - "type": "drilldown.linkToReport" - } - ], - "options": { - "columnFormat": { - "Search Name": { - "align": "auto", - "data": "> table | seriesByName(\"Search Name\") | formatByType(Search_NameColumnFormatEditorConfig)", - "headerAlign": "auto", - "textOverflow": "break-word", - "width": 150 - }, - "_time": { - "width": 60 - }, - "dest_ip": { - "width": 60 - } - }, - "tableFormat": { - "align": "left" - } - }, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Risk Events in Enterprise Security - $dest_ip$", - "type": "splunk.table" - }, - "viz_WhFvmhK9": { - "options": { - "backgroundColor": "#ffffff", - "fontColor": "#f1813f", - "fontSize": "large", - "markdown": "\n### Risk Events\n- Surfaces all risk events tied to the Destination IP \n- Helps you understand what are the ESCU alerts in Enterprise Security\n" - }, - "type": "splunk.markdown" - }, - "viz_ZblgpoVk": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_Q6zbF7Qb" - }, - "description": "This shows the snort signatures matched for this threat", - "eventHandlers": [ - { - "options": { - "tabId": "layout_hEVylosH" - }, - "type": "drilldown.switchToTab" - } - ], - "showLastUpdated": false, - "showProgressBar": false, - "title": "Top Snort Signatures", - "type": "splunk.table" - }, - "viz_darglsFq": { - "containerOptions": {}, - "context": {}, - "dataSources": { - "primary": "ds_q9NVolej" - }, - "options": {}, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Volume Outbound", - "type": "splunk.singlevalue" - }, - "viz_fjbFV5up": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_YybVUCKh" - }, - "description": "This shows the distinct number of affected hosts matched for this threat", - "showLastUpdated": false, - "showProgressBar": false, - "title": "Affected Hosts", - "type": "splunk.singlevalueradial" - }, - "viz_gryqfMyv": { - "options": { - "backgroundColor": "#ffffff", - "fontColor": "#dc4e41", - "fontSize": "large", - "markdown": "\n### Activity Explorer\n\n- Lists all connection and file events related to the affected host for the selected time range" - }, - "type": "splunk.markdown" - }, - "viz_kMW90k69": { - "dataSources": { - "primary": "ds_8sclv3pU" - }, - "description": "This visualizes daily snort events matched for the dest_ip", - "options": { - "xAxisTitleText": "Time", - "yAxisTitleText": "Count of signatures" - }, - "title": "Signatures matched on a Per Day Basis on $dest_ip$", - "type": "splunk.line" - }, - "viz_nr87RKRM": { - "dataSources": { - "primary": "ds_7LZlDEZh" - }, - "eventHandlers": [ - { - "options": { - "tokens": [ - { - "key": "value", - "token": "connection_id" - }, - { - "key": "value", - "token": "dest_ip" - } - ] - }, - "type": "drilldown.setToken" - } - ], - "options": { - "headerVisibility": "fixed", - "showInternalFields": false, - "tableFormat": { - "align": "left" - } - }, - "title": "Connection Events from and to all Source IPs", - "type": "splunk.table" - }, - "viz_q5G96ojA": { - "containerOptions": { - "visibility": {} - }, - "dataSources": { - "primary": "ds_70zt6tTO" - }, - "description": "This table shows you the affected hosts in your environment.", - "eventHandlers": [ - { - "options": { - "tabId": "layout_fRHBDK2O" - }, - "type": "drilldown.switchToTab" - }, - { - "options": { - "tokens": [ - { - "key": "value", - "token": "dest_ip" - } - ] - }, - "type": "drilldown.setToken" - } - ], - "options": { - "backgroundColor": "> themes.defaultBackgroundColor", - "count": 5, - "fontSize": "large", - "headerVisibility": "fixed", - "tableFormat": { - "align": "center", - "headerAlign": "center", - "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByTheme)" - } - }, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Affected Hosts", - "type": "splunk.table" - }, - "viz_uCVQgdVt": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_ULaiHv6R" - }, - "options": { - "backgroundColor": "transparent" - }, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Risk Event Timeline", - "type": "splunk.column" - }, - "viz_wl93h7VE": { - "options": { - "backgroundColor": "#ffffff", - "fontColor": "#dc4e41", - "fontSize": "large", - "markdown": "### Overview\n- Shows the view of threats that are currently being tracked \n- Table of Affected hosts with known snort signatures \n- Ensure that the `cisco_secure_firewall` macro is configured to use the right index\n- The Snort IDs to threat mapping is stored in the following lookups: \n\n - cisco_snort_ids_to_threat_mapping\n - threat_snort_count \n\n### Select a threat from the dropdown and click on the Host IP Address" - }, - "type": "splunk.markdown" - }, - "viz_xuwsrI0Q": { - "containerOptions": {}, - "context": {}, - "dataSources": { - "primary": "ds_XtgOToUG" - }, - "description": "Tables lists the various Mitre techniques found on affected host", - "options": {}, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Mitre Techniques detected on $dest_ip$", - "type": "splunk.pie" - } - }, - "dataSources": { - "ds_0SEcxnrn": { - "name": "risk_events", - "options": { - "enableSmartSources": true, - "query": "| from datamodel Risk.All_Risk | rename normalized_risk_object AS dest_ip | search dest_ip = $dest_ip$\n| stats count by search_name" - }, - "type": "ds.search" - }, - "ds_70zt6tTO": { - "name": "affected_hosts", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat=\"$threat_token$\"\n| stats count by dest_ip\n| rename dest_ip as \"Host IP Address\"\n| table \"Host IP Address\"" - }, - "type": "ds.chain" - }, - "ds_7LZlDEZh": { - "name": "Top Source IP count", - "options": { - "query": "`cisco_secure_firewall` EventType=ConnectionEvent dest_ip = $dest_ip$\n| stats count BY dest_ip src_ip connection_id | sort count" - }, - "type": "ds.search" - }, - "ds_7sRMJ3vQ": { - "name": "snort_ids_threat_actor_lookup", - "options": { - "query": "|inputlookup cisco_snort_ids_to_threat_mapping | table threat signature_id category message \n| stats values(signature_id) as signature_id values(category) as category by threat" - }, - "type": "ds.search" - }, - "ds_8LU6nawL": { - "name": "all_intrusion_events_by_threat_actors", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| stats count by threat" - }, - "type": "ds.chain" - }, - "ds_8sclv3pU": { - "name": "timeline_instruction", - "options": { - "query": "`cisco_secure_firewall` EventType=IntrusionEvent dest_ip = \"$dest_ip$\"\n| timechart span=1d count BY signature_id" - }, - "type": "ds.search" - }, - "ds_PpNvhTDF": { - "name": "dc_signature", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat=\"$threat_token$\"\n| stats dc(signature)" - }, - "type": "ds.chain" - }, - "ds_Q6zbF7Qb": { - "name": "Top Signatures", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat=\"$threat_token$\"\n| stats count by signature | table signature " - }, - "type": "ds.chain" - }, - "ds_QAFOBzEx": { - "name": "volume_inbound", - "options": { - "query": "`cisco_secure_firewall` EventType=ConnectionEvent dest_ip=\"$dest_ip$\"\n| stats sum(InitiatorBytes) AS inbound_bytes\n| eval Volume_Inbound_GB = round(inbound_bytes/1024/1024/1024, 2) . \" Gb\"\n| fields Volume_Inbound_GB" - }, - "type": "ds.search" - }, - "ds_TPwx4BWO": { - "name": "affected_dest_ip", - "options": { - "enableSmartSources": true, - "query": "`cisco_secure_firewall` EventType=IntrusionEvent \n| bin _time span=1d \n| stats count as Total_Alerts dc(signature_id) as sig_count \n values(signature_id) as signature_ids \n values(signature) as signature \n values(class_desc) as class_desc \n values(MitreAttackGroups) as MitreAttackGroups \n values(InlineResult) as InlineResult \n values(InlineResultReason) as InlineResultReason \n values(src_ip) as src_ip \n values(dest_port) as dest_port \n values(rule) as rule \n values(transport) as transport \n values(connection_id) as connection_id\n values(app) as app\n by dest_ip _time \n| eval sig_ids_str = mvjoin(signature_ids, \",\") \n| lookup cisco_snort_ids_to_threat_mapping signature_id as sig_ids_str OUTPUT threat_actor, distinct_count_snort_ids, description \n| where isnotnull(threat_actor) AND sig_count >= tonumber(distinct_count_snort_ids) \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| search threat_actor = \"$threat_actor_token$\"\n| table _time threat_actor description dest_ip signature_ids signature src_ip MitreAttackGroups\n| stats count by dest_ip\n| rename dest_ip as \"Private IP Address\"\n| table \"Private IP Address\"", - "queryParameters": { - "earliest": "$global_time.earliest$", - "latest": "$global_time.latest$" - } - }, - "type": "ds.search" - }, - "ds_ULaiHv6R": { - "name": "risk_event_timeline", - "options": { - "query": "index=risk normalized_risk_object=\"$dest_ip$\"\n| bin _time span=1d\n| stats count AS event_count BY _time\n| timechart span=1d sum(event_count) AS \"Events per Day\"" - }, - "type": "ds.search" - }, - "ds_XtgOToUG": { - "name": "Mitre", - "options": { - "query": "| from datamodel Risk.All_Risk | rename normalized_risk_object AS dest_ip | search dest_ip = $dest_ip$\n| stats\n count by annotations.mitre_attack.mitre_technique \n| head 5\n| rename annotations.mitre_attack.mitre_technique as \"Mitre Techniques\"" - }, - "type": "ds.search" - }, - "ds_YybVUCKh": { - "name": "affect_hosts_count", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat = \"$threat_token$\"\n| stats dc(dest_ip)" - }, - "type": "ds.chain" - }, - "ds_cU42yLz2": { - "name": "file_events_per_day", - "options": { - "query": "`cisco_secure_firewall` EventType=FileEvent src_ip=\"$dest_ip$\" \n| bin _time span=1d \n| stats count AS event_count BY _time \n| timechart span=1d sum(event_count) AS \"File Events per Day\"" - }, - "type": "ds.search" - }, - "ds_f4HzVHsa": { - "name": "description", - "options": { - "query": "| inputlookup threat_snort_count \n| search threat=\"$threat_token$\" \n| table description" - }, - "type": "ds.search" - }, - "ds_fwElVms9": { - "name": "unique_attackers_per_day", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat=\"$threat_token$\" dest_ip=\"$dest_ip$\"\n| timechart span=1d dc(src_ip) AS unique_attacker_count" - }, - "type": "ds.chain" - }, - "ds_i58D84BP": { - "name": "lookup_threat_actors", - "options": { - "enableSmartSources": true, - "query": "| inputlookup cisco_snort_ids_to_threat_mapping | stats count by threat | table threat" - }, - "type": "ds.search" - }, - "ds_m3IAfEaF": { - "name": "snort_evernts_per_actor", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat=\"$threat_token$\"\n| eval _time=strftime(_time, \"%Y-%m-%d\")" - }, - "type": "ds.chain" - }, - "ds_mGcuwEO0": { - "name": "parent_base_search", - "options": { - "query": "`cisco_secure_firewall` EventType=IntrusionEvent \n| stats count AS total_alerts, dc(signature_id) AS sig_count, values(SnortRuleGroups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src_ip) AS src_ip BY _time dest_ip signature_id\n| lookup cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message\n| where isnotnull(threat)\n| bin _time span=1d\n| stats count AS Total_Alerts, dc(signature_id) AS sig_count, values(signature_id) AS signature_id, values(category) AS category, values(message) AS message, values(snort_rule_groups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src_ip) AS src_ip BY _time dest_ip threat\n| lookup threat_snort_count threat OUTPUT description, distinct_count_snort_ids\n| table _time, dest_ip, src_ip, threat, category, message, description, signature_id, signature, snort_rule_groups, sig_count, distinct_count_snort_ids, connection_id, rule, dest_port, transport, app\n| where sig_count >= distinct_count_snort_ids", - "queryParameters": { - "earliest": "$global_time.earliest$", - "latest": "$global_time.latest$" - } - }, - "type": "ds.search" - }, - "ds_q9NVolej": { - "name": "volume_outbound", - "options": { - "query": "`cisco_secure_firewall` EventType=ConnectionEvent dest_ip=\"$dest_ip$\"\n| stats sum(ResponderBytes) AS outbound_bytes\n| eval Volume_Outbound_GB = round(outbound_bytes/1024/1024/1024, 2) . \" Gb\"\n| fields Volume_Outbound_GB" - }, - "type": "ds.search" - }, - "ds_ta3O0H2Z": { - "name": "map_connection_events", - "options": { - "query": "`cisco_secure_firewall` EventType=ConnectionEvent dest_ip = $dest_ip$\n| iplocation src_ip\n| geostats count BY src_ip" - }, - "type": "ds.search" - }, - "ds_tuaeoaIh": { - "name": "all_intrusion_events", - "options": { - "query": "`cisco_secure_firewall` EventType=IntrusionEvent dest_ip = $dest_ip$\n| bin _time span=1d \n| stats count as intrusion_count\n by _time" - }, - "type": "ds.search" - }, - "ds_wzZtYKW7": { - "name": "investigating_host", - "options": { - "query": "| makeresults | eval affected_ip = \"$dest_ip$\" | table affected_ip" - }, - "type": "ds.search" - }, - "ds_z10zC280": { - "name": "file_events", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| join type=inner dest_ip [\n search `cisco_secure_firewall` EventType=FileEvent\n | bin _time span=1d\n | stats count, dc(file_name) as \"File Count\", values(FileDirection) as Direction, values(FileType) as \"File Type\", values(dest_ip) , values(ClientApplication) BY src_ip _time | rename src_ip as dest_ip\n]\n| search dest_ip=\"$dest_ip$\" threat=\"$threat_token$\"\n| table _time dest_ip \"File Count\" Direction \"File Type\" signature\n\n\n" - }, - "type": "ds.chain" - } - }, - "layout": { - "globalInputs": [ - "input_global_trp", - "input_tlWhhLwR" - ], - "layoutDefinitions": { - "layout_1": { - "structure": [ - { - "item": "viz_wl93h7VE", - "position": { - "h": 321, - "w": 1200, - "x": 0, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_8VIu1U0s", - "position": { - "h": 368, - "w": 752, - "x": 0, - "y": 321 - }, - "type": "block" - }, - { - "item": "viz_q5G96ojA", - "position": { - "h": 368, - "w": 448, - "x": 752, - "y": 321 - }, - "type": "block" - } - ], - "type": "grid" - }, - "layout_U25tjhLw": { - "options": { - "gutterSize": 12 - }, - "structure": [ - { - "item": "viz_WhFvmhK9", - "position": { - "h": 106, - "w": 1200, - "x": 0, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_VpTFMowK", - "position": { - "h": 272, - "w": 621, - "x": 0, - "y": 106 - }, - "type": "block" - }, - { - "item": "viz_xuwsrI0Q", - "position": { - "h": 400, - "w": 1200, - "x": 0, - "y": 378 - }, - "type": "block" - }, - { - "item": "viz_uCVQgdVt", - "position": { - "h": 272, - "w": 579, - "x": 621, - "y": 106 - }, - "type": "block" - } - ], - "type": "grid" - }, - "layout_fRHBDK2O": { - "structure": [ - { - "item": "viz_SnsguT0c", - "position": { - "h": 211, - "w": 600, - "x": 0, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_fjbFV5up", - "position": { - "h": 217, - "w": 375, - "x": 0, - "y": 211 - }, - "type": "block" - }, - { - "item": "viz_1ZFeC3zY", - "position": { - "h": 448, - "w": 1200, - "x": 0, - "y": 428 - }, - "type": "block" - }, - { - "item": "viz_ZblgpoVk", - "position": { - "h": 217, - "w": 375, - "x": 375, - "y": 211 - }, - "type": "block" - }, - { - "item": "viz_FY6hwnml", - "position": { - "h": 211, - "w": 600, - "x": 600, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_KQjoxczF", - "position": { - "h": 217, - "w": 450, - "x": 750, - "y": 211 - }, - "type": "block" - } - ], - "type": "grid" - }, - "layout_gX58DqID": { - "structure": [ - { - "item": "viz_70gtzPTV", - "position": { - "h": 137, - "w": 1200, - "x": 0, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_kMW90k69", - "position": { - "h": 322, - "w": 600, - "x": 0, - "y": 137 - }, - "type": "block" - }, - { - "item": "viz_3VU4OAeI", - "position": { - "h": 322, - "w": 600, - "x": 600, - "y": 137 - }, - "type": "block" - } - ], - "type": "grid" - }, - "layout_hEVylosH": { - "structure": [ - { - "item": "viz_gryqfMyv", - "position": { - "h": 99, - "w": 1200, - "x": 0, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_ISoX6BgF", - "position": { - "h": 297, - "w": 594, - "x": 0, - "y": 99 - }, - "type": "block" - }, - { - "item": "viz_nr87RKRM", - "position": { - "h": 290, - "w": 594, - "x": 0, - "y": 396 - }, - "type": "block" - }, - { - "item": "viz_NT8j5Ogy", - "position": { - "h": 537, - "w": 1200, - "x": 0, - "y": 686 - }, - "type": "block" - }, - { - "item": "viz_AQzurdgj", - "position": { - "h": 297, - "w": 606, - "x": 594, - "y": 99 - }, - "type": "block" - }, - { - "item": "viz_T6i68u8y", - "position": { - "h": 290, - "w": 302, - "x": 594, - "y": 396 - }, - "type": "block" - }, - { - "item": "viz_darglsFq", - "position": { - "h": 290, - "w": 304, - "x": 896, - "y": 396 - }, - "type": "block" - } - ], - "type": "grid" - } - }, - "options": { - "submitButton": true, - "submitOnDashboardLoad": true - }, - "tabs": { - "items": [ - { - "label": "Overview", - "layoutId": "layout_1" - }, - { - "label": "Threat Details", - "layoutId": "layout_fRHBDK2O" - }, - { - "label": "Timeline", - "layoutId": "layout_gX58DqID" - }, - { - "label": "Activity Explorer", - "layoutId": "layout_hEVylosH" - }, - { - "label": "Risk Events", - "layoutId": "layout_U25tjhLw" - } - ] - } - }, - "applicationProperties": { - "collapseNavigation": false - } -} \ No newline at end of file diff --git a/dashboards/threat_activity_by_snort_ids.yml b/dashboards/threat_activity_by_snort_ids.yml deleted file mode 100644 index b760a51e62..0000000000 --- a/dashboards/threat_activity_by_snort_ids.yml +++ /dev/null @@ -1,7 +0,0 @@ -name: Threat Activity by Snort IDs -id: 77d805c2-747e-4b78-8979-52deca44254f -version: 2 -creation_date: '2025-04-29' -modification_date: '2026-05-13' -author: Bhavin Patel, Nasreddine Bencherchali, Splunk -description: Utilize this panel to correlate Snort intrusion events with known threat activity. Configure the Snort-ID-to-Threat lookup to enrich incoming signature data and populate the “Threat Activity by Snort IDs” view. From 8426c60c004dae0df68f72c69e7f0b301822cacc Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Tue, 28 Jul 2026 02:43:59 -0700 Subject: [PATCH 050/164] Update codeowners (#4185) --- .github/CODEOWNERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index d1790ddfbe..058ddbe15f 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,3 +1,3 @@ -* @patel-bhavin @ljstella @nasbench +* @patel-bhavin @ljstella @nasbench @pyth0n1c @RavenTait @tccontre @rosplk @p4t12ick /response_templates/ @kbouchardherjavecgroup @ccl0utier @henryy-splunk /.github/workflows/response_templates/mcopenapi_public.yml @kbouchardherjavecgroup @ccl0utier @henryy-splunk \ No newline at end of file From ad0e9bf38dae5287fc0065942a10d11e7fdc0550 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Tue, 28 Jul 2026 03:34:04 -0700 Subject: [PATCH 051/164] Update data source TA and install.yml app versions (#4187) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- data_sources/cisco_network_visibility_module_flow_data.yml | 2 +- data_sources/cisco_network_visibility_module_osquery.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index a34facebf4..2a14064bf2 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:flowdata:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - action - aliul diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 80e6c678e9..442e181c1f 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:osquery:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - current_page - date_hour From 1a3162a22cc283a95f3e23ea0c57ac064e989c8e Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 28 Jul 2026 20:35:19 +0200 Subject: [PATCH 052/164] small fixes --- detections/endpoint/common_ransomware_extensions.yml | 2 +- .../windows_file_without_extension_in_critical_folder.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 495dfc0599..8f922873d4 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -45,7 +45,7 @@ search: | "*.txt", "*.url", "*.vb", "*.vbe", "*.vbs", "*.vcxproj", "*.vhd", "*.vhdx", "*.wav", "*.webm", "*.webp", "*.wim", "*.wsf", "*.xlam", "*.xls", "*.xlsb", "*.xlsm", "*.xlsx", "*.xlt", "*.xltm", "*.xltx", "*.xml", "*.xps", - "*.yaml", "*.yml", "*.zip" + "*.yaml", "*.yml" ) BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index d6efe846e6..0283a3a04e 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -7,7 +7,7 @@ author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Anomaly description: |- - This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, Windows\WinSxS, and other known Windows driver storage and loading paths. + This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, and other known Windows driver storage and loading paths. The analytic leverages telemetry from the Endpoint.Filesystem data model, with a focus on file creation events and file path analysis. File creation activity in these directories—particularly involving extensionless files—is highly suspicious, as it may indicate the presence of destructive or stealthy malware. This behavior is consistent with malware families such as HermeticWiper, which deploy kernel driver components into trusted Windows driver directories to obtain low-level access and execute destructive payloads. From 0b37fe3689ee31d1e783cf4535e5bedbb6047440 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 29 Jul 2026 09:43:28 -0700 Subject: [PATCH 053/164] Bump contentctl.yml and build.yml to 6.4.0 (#4191) --------- Co-authored-by: research bot <research@splunk.com> Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- build.yml | 2 +- contentctl.yml | 2 +- .../powershell___connect_to_internet_with_hidden_window.yml | 4 ++-- .../detections}/regsvr32_with_known_silent_switch_cmdline.yml | 4 ++-- .../detections}/rundll32_createremotethread_in_browser.yml | 4 ++-- .../splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml | 4 ++-- ...unk_code_injection_via_custom_dashboard_leading_to_rce.yml | 4 ++-- .../splunk_enterprise_kv_store_incorrect_authorization.yml | 4 ++-- .../splunk_information_disclosure_on_account_login.yml | 4 ++-- ...lunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml | 4 ++-- .../detections}/splunk_rce_pdfgen_render.yml | 4 ++-- .../windows_process_injection_of_wermgr_to_known_browser.yml | 4 ++-- .../windows_process_injection_with_public_source_path.yml | 4 ++-- 13 files changed, 24 insertions(+), 24 deletions(-) rename {detections/deprecated => removed/detections}/powershell___connect_to_internet_with_hidden_window.yml (98%) rename {detections/deprecated => removed/detections}/regsvr32_with_known_silent_switch_cmdline.yml (99%) rename {detections/deprecated => removed/detections}/rundll32_createremotethread_in_browser.yml (98%) rename {detections/deprecated => removed/detections}/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml (97%) rename {detections/deprecated => removed/detections}/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml (98%) rename {detections/deprecated => removed/detections}/splunk_enterprise_kv_store_incorrect_authorization.yml (98%) rename {detections/deprecated => removed/detections}/splunk_information_disclosure_on_account_login.yml (97%) rename {detections/deprecated => removed/detections}/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml (97%) rename {detections/deprecated => removed/detections}/splunk_rce_pdfgen_render.yml (98%) rename {detections/deprecated => removed/detections}/windows_process_injection_of_wermgr_to_known_browser.yml (98%) rename {detections/deprecated => removed/detections}/windows_process_injection_with_public_source_path.yml (98%) diff --git a/build.yml b/build.yml index d0447873f6..ddabf18dcc 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.3.0 +app_version: 6.4.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index c7d57446e8..d066a0ef9e 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.3.0 + version: 6.4.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU diff --git a/detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml b/removed/detections/powershell___connect_to_internet_with_hidden_window.yml similarity index 98% rename from detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml rename to removed/detections/powershell___connect_to_internet_with_hidden_window.yml index 1d49d65adb..41c33b583d 100644 --- a/detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml +++ b/removed/detections/powershell___connect_to_internet_with_hidden_window.yml @@ -2,9 +2,9 @@ name: PowerShell - Connect To Internet With Hidden Window id: ee18ed37-0802-4268-9435-b3b91aaa18db version: 17 creation_date: '2020-04-29' -modification_date: '2026-06-04' +modification_date: '2026-07-29' author: David Dorsey, Michael Haag Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects PowerShell commands using the WindowStyle parameter to hide the window while connecting to the Internet. This behavior is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions that include variations of the WindowStyle parameter. This activity is significant because it attempts to bypass default PowerShell execution policies and conceal its actions, which is often indicative of malicious intent. If confirmed malicious, this could allow an attacker to execute commands stealthily, potentially leading to unauthorized data exfiltration or further compromise of the endpoint. data_source: diff --git a/detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml b/removed/detections/regsvr32_with_known_silent_switch_cmdline.yml similarity index 99% rename from detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml rename to removed/detections/regsvr32_with_known_silent_switch_cmdline.yml index b9f41a3708..50d253b995 100644 --- a/detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml +++ b/removed/detections/regsvr32_with_known_silent_switch_cmdline.yml @@ -2,9 +2,9 @@ name: Regsvr32 with Known Silent Switch Cmdline id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 version: 15 creation_date: '2021-07-29' -modification_date: '2026-06-09' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed deprecation_info: reason: Detection has been deprecated since its logic is already covered by another more improved detection. removed_in_version: 6.4.0 diff --git a/detections/deprecated/rundll32_createremotethread_in_browser.yml b/removed/detections/rundll32_createremotethread_in_browser.yml similarity index 98% rename from detections/deprecated/rundll32_createremotethread_in_browser.yml rename to removed/detections/rundll32_createremotethread_in_browser.yml index 538e8124ba..d6fd3203da 100644 --- a/detections/deprecated/rundll32_createremotethread_in_browser.yml +++ b/removed/detections/rundll32_createremotethread_in_browser.yml @@ -2,9 +2,9 @@ name: Rundll32 CreateRemoteThread In Browser id: f8a22586-ee2d-11eb-a193-acde48001122 version: 11 creation_date: '2021-07-29' -modification_date: '2026-06-29' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: |- The following analytic detects the suspicious creation of a remote thread by rundll32.exe targeting browser processes such as firefox.exe, chrome.exe, iexplore.exe, and microsoftedgecp.exe. diff --git a/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml b/removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml similarity index 97% rename from detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml rename to removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml index a377c05c21..be485288dc 100644 --- a/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml +++ b/removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml @@ -2,9 +2,9 @@ name: Splunk App for Lookup File Editing RCE via User XSLT id: a053e6a6-2146-483a-9798-2d43652f3299 version: 8 creation_date: '2023-11-16' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic identifies the creation of lookup files in Splunk, which could indicate an attempt to exploit remote code execution via user-supplied XSLT. It leverages REST API queries to monitor the creation of these lookups, focusing on fields such as title, author, and access control lists. This activity is significant because it targets a known vulnerability in Splunk versions 9.1.x, potentially allowing attackers to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, compromising the integrity and security of the Splunk environment. data_source: [] diff --git a/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml b/removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml similarity index 98% rename from detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml rename to removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml index 16c8972fdd..1d542bc409 100644 --- a/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml +++ b/removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml @@ -2,9 +2,9 @@ name: Splunk Code Injection via custom dashboard leading to RCE id: b06b41d7-9570-4985-8137-0784f582a1b3 version: 8 creation_date: '2022-12-19' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto -status: deprecated +status: removed type: Hunting description: The following analytic identifies attempts to exploit a vulnerability in Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, where an authenticated user can execute arbitrary code via the dashboard PDF generation component. It detects this activity by analyzing events in the _internal index with the file=export parameter. This behavior is significant because it indicates a potential code injection attack, which could lead to remote code execution (RCE). If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary commands, and potentially compromise the entire Splunk environment. data_source: [] diff --git a/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml b/removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml similarity index 98% rename from detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml rename to removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml index 048f7f1d47..7853338daa 100644 --- a/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml +++ b/removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml @@ -2,9 +2,9 @@ name: Splunk Enterprise KV Store Incorrect Authorization id: 8f0e8380-a835-4f2b-b749-9ce119364df0 version: 9 creation_date: '2024-01-22' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Eric McGinnis, Chase Franklin -status: deprecated +status: removed type: Hunting description: The following analytic detects unauthorized attempts to reload Splunk KV Store collections via the REST API. It leverages internal index logs to identify POST requests to the `/servicesNS/nobody/search/admin/collections-conf/_reload` endpoint, focusing on status codes starting with '2'. This activity is significant as it may indicate improper permission handling, potentially leading to unauthorized deletion of KV Store collections. If confirmed malicious, this could result in data loss or unauthorized data manipulation, impacting the integrity and availability of critical Splunk data. data_source: diff --git a/detections/deprecated/splunk_information_disclosure_on_account_login.yml b/removed/detections/splunk_information_disclosure_on_account_login.yml similarity index 97% rename from detections/deprecated/splunk_information_disclosure_on_account_login.yml rename to removed/detections/splunk_information_disclosure_on_account_login.yml index 2e3d38b171..fc0d6959d8 100644 --- a/detections/deprecated/splunk_information_disclosure_on_account_login.yml +++ b/removed/detections/splunk_information_disclosure_on_account_login.yml @@ -2,9 +2,9 @@ name: Splunk Information Disclosure on Account Login id: 2bae5d19-6d1b-4db0-82ab-0af5ac5f836c version: 8 creation_date: '2024-07-01' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto -status: deprecated +status: removed type: Hunting description: This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server. data_source: diff --git a/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml b/removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml similarity index 97% rename from detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml rename to removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml index ec3f314307..e211c92821 100644 --- a/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml +++ b/removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml @@ -2,9 +2,9 @@ name: Splunk Path Traversal In Splunk App For Lookup File Edit id: 8ed58987-738d-4917-9e44-b8ef6ab948a6 version: 9 creation_date: '2023-06-01' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Eric McGinnis -status: deprecated +status: removed type: Hunting description: The following analytic identifies path traversal attempts in the Splunk App for Lookup File Editing. It detects specially crafted web requests targeting lookup files by analyzing the `uri_query` field in the `_internal` index. This activity is significant because it allows low-privilege users to read and write to restricted areas of the Splunk installation directory, potentially accessing sensitive files like password hashes. If confirmed malicious, this could lead to unauthorized access, data breaches, and further exploitation of the Splunk environment. data_source: diff --git a/detections/deprecated/splunk_rce_pdfgen_render.yml b/removed/detections/splunk_rce_pdfgen_render.yml similarity index 98% rename from detections/deprecated/splunk_rce_pdfgen_render.yml rename to removed/detections/splunk_rce_pdfgen_render.yml index 666040de17..3d3aa7b3b2 100644 --- a/detections/deprecated/splunk_rce_pdfgen_render.yml +++ b/removed/detections/splunk_rce_pdfgen_render.yml @@ -2,9 +2,9 @@ name: Splunk RCE PDFgen Render id: bc2b7437-0400-438b-9537-21ab5b7d2d53 version: 8 creation_date: '2024-07-01' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Chase Franklin -status: deprecated +status: removed type: TTP description: This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote data_source: diff --git a/detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml b/removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml similarity index 98% rename from detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml rename to removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml index 31a5198164..268c78c9d9 100644 --- a/detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml +++ b/removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml @@ -2,9 +2,9 @@ name: Windows Process Injection Of Wermgr to Known Browser id: aec755a5-3a2c-4be0-ab34-6540e68644e9 version: 12 creation_date: '2022-10-28' -modification_date: '2026-06-29' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies the suspicious remote thread execution of the wermgr.exe process into known browsers such as firefox.exe, chrome.exe, and others. It leverages Sysmon EventCode 8 logs to detect this behavior by monitoring SourceImage and TargetImage fields. This activity is significant because it is indicative of Qakbot malware, which injects malicious code into legitimate processes to steal information. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host. data_source: diff --git a/detections/deprecated/windows_process_injection_with_public_source_path.yml b/removed/detections/windows_process_injection_with_public_source_path.yml similarity index 98% rename from detections/deprecated/windows_process_injection_with_public_source_path.yml rename to removed/detections/windows_process_injection_with_public_source_path.yml index 83a6938abc..a282a5827a 100644 --- a/detections/deprecated/windows_process_injection_with_public_source_path.yml +++ b/removed/detections/windows_process_injection_with_public_source_path.yml @@ -2,9 +2,9 @@ name: Windows Process Injection With Public Source Path id: 492f09cf-5d60-4d87-99dd-0bc325532dda version: 11 creation_date: '2022-09-05' -modification_date: '2026-06-29' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects a process from a non-standard file path on Windows attempting to create a remote thread in another process. This is identified using Sysmon EventCode 8, focusing on processes not originating from typical system directories. This behavior is significant as it often indicates process injection, a technique used by adversaries to evade detection or escalate privileges. If confirmed malicious, this activity could allow an attacker to execute arbitrary code within another process, potentially leading to unauthorized actions and further compromise of the system. data_source: From 8c42801be839fa3d870c841dcc3e627235f753a0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 29 Jul 2026 09:44:49 -0700 Subject: [PATCH 054/164] Update data source TA and install.yml app versions (#4190) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- data_sources/cisco_ai_defense_alerts.yml | 2 +- data_sources/cisco_asa_logs.yml | 2 +- data_sources/cisco_duo_activity.yml | 2 +- data_sources/cisco_duo_administrator.yml | 2 +- data_sources/cisco_isovalent_process_connect.yml | 2 +- data_sources/cisco_isovalent_process_exec.yml | 2 +- data_sources/cisco_isovalent_process_kprobe.yml | 2 +- data_sources/cisco_network_visibility_module_flow_data.yml | 2 +- data_sources/cisco_network_visibility_module_osquery.yml | 2 +- .../cisco_secure_firewall_threat_defense_connection_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_file_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_intrusion_event.yml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index f6d66b2b29..1404dec13c 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -11,5 +11,5 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index bf1e8a39ca..1a8e032607 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - Cisco_ASA_action - Cisco_ASA_message_id diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index 36c79c9f75..ef4d9c214e 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - access_device.browser - access_device.browser_version diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index 27c88ee60e..c9e8471027 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - action - actionlabel diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index 38e7825a81..4176c4e24e 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - _time - app diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index eed09ca0be..fbc9e8fda2 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - _time - cluster_name diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 637361a36c..9b5f9b9fc8 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - _time - app diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index 2a14064bf2..35fb13dd7a 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:flowdata:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - action - aliul diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 442e181c1f..710ef263b0 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:osquery:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - current_page - date_hour diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index 895f9fe20a..2e6a88ad82 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - AC_RuleAction - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index d623fdb85a..022971efeb 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - app - Application diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index 4d9589c58e..1552ce4c57 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - Application - Classification From 1cd64005319bdcbb7d7b0553086d147555441e43 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Mon, 3 Aug 2026 01:15:19 -0700 Subject: [PATCH 055/164] Update data source TA and install.yml app versions (#4197) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- data_sources/azure_active_directory.yml | 2 +- ...e_directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- data_sources/azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_microsoftgraphactivitylogs.yml | 2 +- .../azure_active_directory_noninteractiveusersigninlogs.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- data_sources/crowdstrike_falcon_stream_alert.yml | 2 +- data_sources/crowdstrike_processrollup2.yml | 2 +- data_sources/linux_auditd_add_user.yml | 2 +- data_sources/linux_auditd_cwd.yml | 2 +- data_sources/linux_auditd_daemon_abort.yml | 2 +- data_sources/linux_auditd_daemon_end.yml | 2 +- data_sources/linux_auditd_daemon_start.yml | 2 +- data_sources/linux_auditd_execve.yml | 2 +- data_sources/linux_auditd_path.yml | 2 +- data_sources/linux_auditd_proctitle.yml | 2 +- data_sources/linux_auditd_service_stop.yml | 2 +- data_sources/linux_auditd_syscall.yml | 2 +- data_sources/linux_messages_syslog.yml | 2 +- data_sources/linux_secure.yml | 2 +- data_sources/m365_copilot_graph_api.yml | 2 +- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/o365.yml | 2 +- data_sources/o365_add_app_role_assignment_grant_to_user_.yml | 2 +- .../o365_add_app_role_assignment_to_service_principal_.yml | 2 +- data_sources/o365_add_mailboxpermission.yml | 2 +- data_sources/o365_add_member_to_role_.yml | 2 +- data_sources/o365_add_owner_to_application_.yml | 2 +- data_sources/o365_add_service_principal_.yml | 2 +- data_sources/o365_change_user_license_.yml | 2 +- data_sources/o365_consent_to_application_.yml | 2 +- data_sources/o365_disable_strong_authentication_.yml | 2 +- data_sources/o365_mailitemsaccessed.yml | 2 +- data_sources/o365_modifyfolderpermissions.yml | 2 +- data_sources/o365_set_company_information_.yml | 2 +- data_sources/o365_set_mailbox.yml | 2 +- data_sources/o365_update_application_.yml | 2 +- data_sources/o365_update_authorization_policy_.yml | 2 +- data_sources/o365_update_user_.yml | 2 +- data_sources/o365_userloggedin.yml | 2 +- data_sources/o365_userloginfailed.yml | 2 +- data_sources/office_365_reporting_message_trace.yml | 2 +- data_sources/office_365_universal_audit_log.yml | 2 +- data_sources/okta.yml | 2 +- data_sources/palo_alto_network_threat.yml | 2 +- data_sources/palo_alto_network_traffic.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- install.yml | 2 +- 223 files changed, 223 insertions(+), 223 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index c40126191c..4607235dc4 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index bd7fc59c23..b63f18820d 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index dbe9bbafd8..e0143b8282 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index d80e70b155..825b34c64b 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index efe8b33ddb..12129d2b6c 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 47f47f1900..11f6b92811 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index afce3a4582..31d80aad7b 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 55fa3c5e41..43dd2a556e 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index a421c79763..129a3a1fb5 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 3f8eab8b67..bce7344352 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index 1ad5447148..c7f5b9a219 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index dfd4ba9321..87f204eb6f 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index e2a3e40ce3..fbc4851ba9 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index 1a462fcf5d..d8910cfa60 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 1dd734b3c2..2270baea06 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index bf04e2a317..f1f93bb50a 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index e08314d029..b81255026c 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 44405c5e8b..5713917371 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 3d53d8c6c7..a093e8e01c 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index 67d95cdb65..e0ec05a9f5 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index c4f6cc2598..a267a7365b 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 010c2162c1..49aaff4b2a 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 8b13e8bdc2..4c8f1145d8 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 55c95ea4ad..805f634c52 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 3809b00a30..71f8b3e5cd 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 7270838ad1..e79e168f52 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 614f3fd068..1ecf190e17 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 6562a321da..4b95dba5c9 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 84c522f2f4..d49419a496 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 4929e2e883..af9675c580 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index b8105c4862..6337447b95 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index c234e022e6..23e8cfc587 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index e52c960d46..8069985786 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index abcf17e438..c192eec08f 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index c88017ac48..9f8e54c0b0 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index ee363cb8cd..84df312158 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index d19da791f6..ffb232cf7d 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 2346b22494..7f8a42b305 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 38d1565418..36d941e095 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index c39f7ca141..8fb94ecdd2 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 060a86c2dc..b40bdbc8aa 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index 924c2c1367..14a6f7bf67 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index 83b42f8449..40b994aea0 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 06a7cd7584..405e216639 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index a6b0eeca89..d058bd83b4 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 272e734d13..ee76b1b6c4 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index afebb51c8f..8befb435c8 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 172b11719d..bf63205891 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index c24c6c2417..883fb202b5 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index ac76f2f355..b071d6907d 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 9f834c10ce..d3f179ec63 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index 22e5498275..e92163adc2 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 37d43a3286..8155bef777 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 34e190129c..92c5655c6c 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index c3264444c1..4e07364aa9 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 7858189b11..9c3ec05bf8 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 9790a74d67..0f07c4ba64 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 2e58b10a33..bb02c750ca 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 755e03f508..6d8968e44d 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index cd980da894..3455d837c4 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index eb0cdc7ecf..2bf501a18b 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.1.2 + version: 8.2.1 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index b2bda6430e..a74705eac4 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - AwsAccountId diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 4b353862ea..ff54229c4a 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 182d512dca..dabaaa7d98 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 5031b5cd33..148ad9f53d 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index f0c01197f6..6a3682061c 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index c5e2c3a4e5..a89d51760a 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 7b4411afbd..86ec0e593c 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 1461a8eaa6..2d3dddff8e 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 177b30e212..10b5050e7b 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index b7fd87116e..2926d693c9 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 22983a3d9f..5c989625b7 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 65cb093d4f..51cf097b18 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 8c5adbf8ae..161a1d8a1a 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index da60f90a28..bf82955119 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 9a0c666f20..3b2864dfe1 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index d6888c0dee..ec07057d4d 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index b0ae6b37c9..94311f56f8 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 7a086791e4..adb75dd369 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index f0ca04a229..81c651980d 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index ce39762a76..3b99c45001 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index fb083554f3..c08a28064f 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 1c61b96dac..6a5cb1015f 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index c1d309bda9..0527fe9105 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 5b89633bdb..c9824bf865 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - column - action diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index dceb6eef93..2ff079b443 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -17,7 +17,7 @@ separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.0.0 + version: 3.1.2 fields: - action - description diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index 24d29df959..a44d6511ad 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -18,7 +18,7 @@ separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.0.0 + version: 3.1.2 fields: - AuthenticationId - AuthenticationId_meaning diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 164e9aefb7..52378a5ee6 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index afbe0ec701..d39ee1fddc 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index 9b83e49dc1..e46aa9c326 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index f7b4fcf4dd..0522a1d413 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 9f96075a6e..4024d17bc8 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index 1d5c039877..e72fcaef2f 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 6f0953cec0..1ec1119e7d 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 44e2a8935b..4b3af11875 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 1db5103e14..71d083b8e5 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index b5d9647033..7582dd5dc0 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 4990b9710d..7e89cd959e 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -15,7 +15,7 @@ sourcetype: linux_messages_syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - _time - action diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index b8dd8ae5ba..f01804afa2 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - _time - action diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index 33aec6362d..eef7d37443 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -10,7 +10,7 @@ sourcetype: o365:graph:api supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - appDisplayName - appId diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 141ebdf0de..d39701e698 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index da24c4688c..2b877cc416 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index e4ec349eb5..f237105113 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/o365.yml b/data_sources/o365.yml index a19cd4ad78..4184acc03e 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -17,4 +17,4 @@ separator: Operation supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 7723ded61a..1687c98ff8 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment grant to user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 8654f39dbd..925288235d 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 39b8cabf1c..79d4333bbb 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -17,7 +17,7 @@ separator_value: Add-MailboxPermission supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - AccessRights diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index 203e698796..a69da205d9 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -17,7 +17,7 @@ separator_value: Add member to role. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index 78a3be49c4..aa2db39030 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 3f55630da5..3b4615afa7 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index 63af5c5dce..d6451bc035 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -17,7 +17,7 @@ separator_value: Change user license. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index d4a327cfbe..f12ada70fd 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Consent to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index 65923c1c80..3e75abb378 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -17,7 +17,7 @@ separator_value: Disable Strong Authentication. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index 8174ccfa10..3860a0da92 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -17,7 +17,7 @@ separator_value: MailItemsAccessed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - AppId diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index 94b626b468..bf30472105 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -17,7 +17,7 @@ separator_value: ModifyFolderPermissions supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - AppId diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index b093098610..e40e2d4917 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -17,7 +17,7 @@ separator_value: Set Company Information. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_set_mailbox.yml b/data_sources/o365_set_mailbox.yml index 96c5ad2283..07dff02233 100644 --- a/data_sources/o365_set_mailbox.yml +++ b/data_sources/o365_set_mailbox.yml @@ -17,7 +17,7 @@ separator_value: Set-Mailbox supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - AppId diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 949c78147e..48912324ff 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -17,7 +17,7 @@ separator_value: Update application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index 7bae300e3d..0feeb95bdf 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -17,7 +17,7 @@ separator_value: Update authorization policy. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 16dce5cfdb..0b264ec1b2 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -17,7 +17,7 @@ separator_value: Update user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 8471cc627b..0402ece5bf 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -17,7 +17,7 @@ separator_value: UserLoggedIn supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index a898d3063e..61907c7546 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -17,7 +17,7 @@ separator_value: UserLoginFailed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/office_365_reporting_message_trace.yml b/data_sources/office_365_reporting_message_trace.yml index ef82a079e7..1c2f9ffefc 100644 --- a/data_sources/office_365_reporting_message_trace.yml +++ b/data_sources/office_365_reporting_message_trace.yml @@ -11,7 +11,7 @@ separator: Organization supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - FromIP - Index diff --git a/data_sources/office_365_universal_audit_log.yml b/data_sources/office_365_universal_audit_log.yml index 0e03e59a90..c9273ae119 100644 --- a/data_sources/office_365_universal_audit_log.yml +++ b/data_sources/office_365_universal_audit_log.yml @@ -11,7 +11,7 @@ separator: Operation supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time example_log: '' diff --git a/data_sources/okta.yml b/data_sources/okta.yml index 13546f1ac4..aead16fbc8 100644 --- a/data_sources/okta.yml +++ b/data_sources/okta.yml @@ -16,7 +16,7 @@ sourcetype: OktaIM2:log supported_TA: - name: Splunk Add-on for Okta Identity Cloud url: https://splunkbase.splunk.com/app/6553 - version: 5.0.3 + version: 5.1.0 output_fields: - dest - src diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index b83bd67d0b..9567c997b9 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.1.0 + version: 3.2.2 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 00e9798ece..ac49f6e6a4 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.1.0 + version: 3.2.2 fields: - _time - date_hour diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6a20ab8128..72049e5869 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 7e1ec4fde7..467fcb8c93 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 4ef6ecee00..87a33c03d7 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index fb960b1d42..4b07db29e4 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 9107707eaf..a968dd1a46 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index a98f34690b..99771041c1 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index b45b9b50fa..4d554be982 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 869197ab81..ef814e9419 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 792a15ebbc..56dd08571e 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 22e3b71725..d248fdad0b 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 00920b4b37..2630d7acd9 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 2701795166..40b8c31424 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index f4e7771023..bf5fcbfe1c 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 14d92e22a7..e013ce4852 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 011347afb2..0782a1766a 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 9c97a01efe..46328a91ec 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 77928d8273..f812bf2ba7 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event> diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index b0b5c2cef0..a55e60a833 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 8d9767ba9c..2cab226711 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 7b59c9cd6b..4d5ec9e1e9 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 1a813f46f9..f71c298db6 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 88cb4531d3..22cac0ee65 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 3b54c95906..ff75374cba 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 882e7a7bd0..8a95469e85 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 257bd4a5d4..2f0f18d30a 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 529620eb60..d6913f17fd 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index d952de1f7e..20f2a25647 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 6bd7d957fc..69570a5152 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 3dbf23664f..8229353cbb 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 8586c6984d..d565bd678c 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 3971f62bfc..9c368278f1 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 28e5d9fead..06fee295e2 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index e8c1fb0efb..de3c2985d1 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 6b8fa7d829..3dab3df349 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index c0dc0121e4..63d9abb19a 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index f74d26c94a..fef6cdc255 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 280d7f8262..5cb9cb7293 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 642687b596..bd8db10525 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 3b4b6a9c06..b1a0fb75b7 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index a80ed23a9b..245516a91d 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 4dc60cd9bd..b5e97eaea3 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 7184ff77e3..fe586a0e05 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 5c1d729155..0b547c560e 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 06b3adb988..f5e9594ee2 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 31484a3587..639a929eef 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 26eb1728db..d3eb5cb959 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 0b06b7823a..9ddcc5c979 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index ca05c7b840..023b26bec6 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 6ddc2aba57..d84a40ce41 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 0aa2c2f0b7..0b186ffe53 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index bcba79a79d..eee3ce49e9 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 9487a6ac52..a7767a8044 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 30f8bc23e8..7eb00e3339 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index d95f852eb8..3378e6e686 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index f128bbfcc4..6e188c3a96 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index fb6f1f3ca8..f3a7e58f4a 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index b0f6314703..ba5cda42f7 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 7b643fb3d0..e93e8d3315 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index eb26156fe9..0efdb2a2ac 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 216eb54d2c..cda72a3f2d 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 8b61381ede..f4313a9442 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 4dbe460a36..14bc6a8571 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index c53348491f..516568e8f5 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 9db0814db3..cae6d0e8b4 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 0d954d3b5c..5cfb55837f 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 2b1506eda9..4c22ad7160 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 16751ea4ef..61daf2795d 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 408aaa466b..b12b8773bf 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index ed8f3691a8..2eeb4b66b8 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index 4b239b5056..e73ca75974 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 8a945e0fe8..323438675c 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 70bae43f05..9b3a4671cf 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 8eebe0e5a9..9a395af8a1 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index bdd7735a81..668f9a2654 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 9379641c7d..940fdaf357 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 2016e280f6..e5132ceded 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 2d9e806305..3052e227a2 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index b10ef8870b..4d0095a0d6 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 961be864ee..a483476732 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index b2035008e4..d122ec1a22 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 253ce10397..67277b5148 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index f5f3cf1116..8b83750b00 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 393098f288..045fad9d03 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 1647d2e832..12eeaac238 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index faea29ccad..e7af3737a9 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 49df88f658..e18a77235a 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 642359a985..95e752daca 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index dd3e3849ea..93b05f75d3 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 0cf395b1d2..f961b153ae 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 518d67eacf..47707be7dc 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index a1fda46fe8..05a05f8eaa 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index e7fe0ff722..a2f4dda16d 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 01ff84004b..ed2d6b8bb7 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index a3412a3b42..64204e7070 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 8c6977fd3a..cae7b41acf 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ComputerName diff --git a/install.yml b/install.yml index 2b299ead90..b33bb853c5 100644 --- a/install.yml +++ b/install.yml @@ -24,7 +24,7 @@ apps: version: 1.3.2 - appid: Splunk_TA_google-cloudplatform url: https://splunkbase.splunk.com/app/3088 - version: 5.0.3 + version: 5.1.0 - appid: utbox url: https://splunkbase.splunk.com/app/2734 version: 1.9.4 From a27e7764346331a7ef8fccfe9d9778d2bb9388bd Mon Sep 17 00:00:00 2001 From: Cole Munz <Munzzyy1@proton.me> Date: Mon, 3 Aug 2026 03:44:50 -0500 Subject: [PATCH 056/164] Fix WILDCARD field name in malware_user_agents lookup (#4196) --- lookups/csv/malware_user_agents.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lookups/csv/malware_user_agents.yml b/lookups/csv/malware_user_agents.yml index 19a7fac111..ee4b37bda5 100644 --- a/lookups/csv/malware_user_agents.yml +++ b/lookups/csv/malware_user_agents.yml @@ -1,12 +1,12 @@ name: malware_user_agents id: 3a1a501c-d65f-4a6c-95a3-3d2b9a8c43c3 -version: 2 +version: 3 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-08-02' author: Raven Tait, Splunk lookup_type: csv description: A list of user agents used with known malware. match_type: - - WILDCARD(malware_user_agents) + - WILDCARD(malware_user_agent) min_matches: 1 case_sensitive_match: true From 824e093cba94f3eba3dff9ca68c9f221bfc74948 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 5 Aug 2026 03:11:33 -0700 Subject: [PATCH 057/164] Update data source TA and install.yml app versions (#4200) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- install.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install.yml b/install.yml index b33bb853c5..60db3de09f 100644 --- a/install.yml +++ b/install.yml @@ -3,7 +3,7 @@ apps: hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz - appid: SplunkEnterpriseSecuritySuite url: https://splunkbase.splunk.com/app/263 - version: 8.5.1 + version: 8.6.1 - appid: Splunk_TA_microsoft-iis url: https://splunkbase.splunk.com/app/3185 version: 2.0.0 From 42005101ca0ef3238ce6433eb9a6279109e0d158 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 5 Aug 2026 09:05:31 -0700 Subject: [PATCH 058/164] Pin the Windows TA Version in Updater (#4203) --- .github/workflows/datasource-dependabot.yml | 5 +++++ data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- .../windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 99 files changed, 103 insertions(+), 98 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 654ac85d84..6553786624 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -31,6 +31,11 @@ jobs: run: | echo "Updating data source supported_TA and repo install.yml app versions" contentctl-ng update-data-source-tas --content-dirs . + + # TODO: Remove this when we are fully compatible with the latest version of the Windows TA + # Temporarily roll back any automated updates to the Windows TA because we intentionally + # want to pin to the current version. + git checkout -- $(grep -rl "https://splunkbase.splunk.com/app/742" data_sources/) echo "Changed data source and install.yml files:" git status --short -- data_sources install.yml diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index d39701e698..141ebdf0de 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index 2b877cc416..da24c4688c 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index f237105113..e4ec349eb5 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 72049e5869..6a20ab8128 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 467fcb8c93..7e1ec4fde7 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 87a33c03d7..4ef6ecee00 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index 4b07db29e4..fb960b1d42 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index a968dd1a46..9107707eaf 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 99771041c1..a98f34690b 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index 4d554be982..b45b9b50fa 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index ef814e9419..869197ab81 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 56dd08571e..792a15ebbc 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index d248fdad0b..22e3b71725 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 2630d7acd9..00920b4b37 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 40b8c31424..2701795166 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index bf5fcbfe1c..f4e7771023 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index e013ce4852..14d92e22a7 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 0782a1766a..011347afb2 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 46328a91ec..9c97a01efe 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index f812bf2ba7..77928d8273 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event> diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index a55e60a833..b0b5c2cef0 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 2cab226711..8d9767ba9c 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 4d5ec9e1e9..7b59c9cd6b 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index f71c298db6..1a813f46f9 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 22cac0ee65..88cb4531d3 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index ff75374cba..3b54c95906 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 8a95469e85..882e7a7bd0 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 2f0f18d30a..257bd4a5d4 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index d6913f17fd..529620eb60 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index 20f2a25647..d952de1f7e 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 69570a5152..6bd7d957fc 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 8229353cbb..3dbf23664f 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index d565bd678c..8586c6984d 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 9c368278f1..3971f62bfc 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 06fee295e2..28e5d9fead 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index de3c2985d1..e8c1fb0efb 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 3dab3df349..6b8fa7d829 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index 63d9abb19a..c0dc0121e4 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index fef6cdc255..f74d26c94a 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 5cb9cb7293..280d7f8262 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index bd8db10525..642687b596 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index b1a0fb75b7..3b4b6a9c06 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 245516a91d..a80ed23a9b 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index b5e97eaea3..4dc60cd9bd 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index fe586a0e05..7184ff77e3 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 0b547c560e..5c1d729155 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index f5e9594ee2..06b3adb988 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 639a929eef..31484a3587 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index d3eb5cb959..26eb1728db 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 9ddcc5c979..0b06b7823a 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 023b26bec6..ca05c7b840 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index d84a40ce41..6ddc2aba57 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 0b186ffe53..0aa2c2f0b7 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index eee3ce49e9..bcba79a79d 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index a7767a8044..9487a6ac52 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 7eb00e3339..30f8bc23e8 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 3378e6e686..d95f852eb8 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 6e188c3a96..f128bbfcc4 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index f3a7e58f4a..fb6f1f3ca8 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index ba5cda42f7..b0f6314703 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index e93e8d3315..7b643fb3d0 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 0efdb2a2ac..eb26156fe9 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index cda72a3f2d..216eb54d2c 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index f4313a9442..8b61381ede 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 14bc6a8571..4dbe460a36 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index 516568e8f5..c53348491f 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index cae6d0e8b4..9db0814db3 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 5cfb55837f..0d954d3b5c 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 4c22ad7160..2b1506eda9 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 61daf2795d..16751ea4ef 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index b12b8773bf..408aaa466b 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index 2eeb4b66b8..ed8f3691a8 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index e73ca75974..4b239b5056 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 323438675c..8a945e0fe8 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 9b3a4671cf..70bae43f05 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 9a395af8a1..8eebe0e5a9 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 668f9a2654..bdd7735a81 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 940fdaf357..9379641c7d 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index e5132ceded..2016e280f6 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 3052e227a2..2d9e806305 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 4d0095a0d6..b10ef8870b 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index a483476732..961be864ee 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index d122ec1a22..b2035008e4 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 67277b5148..253ce10397 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 8b83750b00..f5f3cf1116 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 045fad9d03..393098f288 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 12eeaac238..1647d2e832 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index e7af3737a9..faea29ccad 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index e18a77235a..49df88f658 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 95e752daca..642359a985 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 93b05f75d3..dd3e3849ea 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index f961b153ae..0cf395b1d2 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 47707be7dc..518d67eacf 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 05a05f8eaa..a1fda46fe8 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index a2f4dda16d..e7fe0ff722 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index ed2d6b8bb7..01ff84004b 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 64204e7070..a3412a3b42 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index cae7b41acf..8c6977fd3a 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ComputerName From 0aa0a079bef4fb1ee6231d68067e436fdcdde4de Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 5 Aug 2026 09:09:48 -0700 Subject: [PATCH 059/164] Update data source TA and install.yml app versions (#4204) Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- data_sources/g_suite_drive.yml | 2 +- data_sources/g_suite_gmail.yml | 2 +- data_sources/google_workspace.yml | 2 +- data_sources/google_workspace_login_failure.yml | 2 +- data_sources/google_workspace_login_success.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index 2fe9a8b87d..b647bf3974 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -16,7 +16,7 @@ sourcetype: gsuite:drive:json supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 4.0.0 + version: 5.0.0 fields: - _time - email diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index a536a2cca4..47a7e83990 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -15,7 +15,7 @@ sourcetype: gsuite:gmail:bigquery supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 4.0.0 + version: 5.0.0 fields: - _time - action_type diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index e6085340b3..bde99e8ec1 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -10,7 +10,7 @@ sourcetype: gws:reports:login supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 4.0.0 + version: 5.0.0 fields: - action - actor.callerType diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index ac3e4a7855..774e7c8921 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -17,7 +17,7 @@ separator_value: login_failure supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 4.0.0 + version: 5.0.0 fields: - _time - actor.email diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 353d1d40cf..727e82de8e 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -17,7 +17,7 @@ separator_value: login_success supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 4.0.0 + version: 5.0.0 fields: - _time - actor.email From 33064e8eda849462017836f9d80ffd8b5da23b29 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Wed, 5 Aug 2026 18:48:54 +0200 Subject: [PATCH 060/164] Fix Issues - 6.4 Batch (#4202) --- ...le_written_in_administrative_smb_share.yml | 47 +++++++++-- ...equency_copy_of_files_in_network_share.yml | 84 +++++++++++++++++-- ...etwork_share_discovery_via_dir_command.yml | 49 +++++++++-- ...sable_shutdown_button_through_registry.yml | 53 ++++++++++-- ...y_dotnet_etw_disabled_via_env_variable.yml | 40 +++++++-- .../windows_user_discovery_via_net.yml | 75 +++++++++++------ 6 files changed, 288 insertions(+), 60 deletions(-) diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index c31e9faea7..f9f1611df1 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -1,23 +1,56 @@ name: Executable File Written in Administrative SMB Share id: f63c34fe-a435-11eb-935a-acde48001122 -version: 13 +version: 14 creation_date: '2021-04-26' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution. If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network. +description: |- + The following analytic detects executable files (.exe, .dll, etc.) being written to Windows administrative SMB shares (Admin$, IPC$, C$). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. + This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution. + If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network. data_source: - Windows Event Log Security 5145 -search: '`wineventlog_security` EventCode=5145 RelativeTargetName IN ("*.exe","*.dll") ObjectType=File ShareName IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") AccessMask= "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode ShareName RelativeTargetName ObjectType AccessMask src_user src_port IpAddress dest | `security_content_ctime(firstTime)` | `executable_file_written_in_administrative_smb_share_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. -known_false_positives: System Administrators may use looks like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list. +search: |- + `wineventlog_security` + EventCode=5145 + RelativeTargetName IN ( + "*.cpl", + "*.dll", + "*.exe", + "*.sys" + ) + ObjectType=File + ShareName IN ( + "\\\\*\\Admin$", + "\\\\*\\C$", + "\\\\*\\IPC$" + ) + + | eval AccessMask_ = tonumber(AccessMask, 16) + | where (bit_and(AccessMask_, 2) != 0) OR (bit_and(AccessMask_, 4) != 0) + + | stats min(_time) as firstTime + max(_time) as lastTime count + + by EventCode ShareName RelativeTargetName ObjectType + AccessMask src_user src_port IpAddress dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `executable_file_written_in_administrative_smb_share_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: |- + System Administrators may use tools like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list. references: - https://attack.mitre.org/techniques/T1021/002/ - https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/ - https://labs.vipre.com/trickbot-and-its-modules/ - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145#table-of-file-access-codes drilldown_searches: - name: View the detection results for - "$src_user$" search: '%original_detection_search% | search src_user = "$src_user$"' @@ -28,7 +61,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: $src_user$ dropped or created an executable file in known sensitive SMB share. Share name=$ShareName$, Target name=$RelativeTargetName$, and Access mask=$AccessMask$ + title: The [$src_user$] dropped or created an executable file in known sensitive SMB share. Share name=[$ShareName$], Target name=[$RelativeTargetName$], and Access mask=[$AccessMask$] entity: field: src_user type: user diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml index 40ef758fea..70fbfb414a 100644 --- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml +++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml @@ -1,19 +1,89 @@ name: High Frequency Copy Of Files In Network Share id: 40925f12-4709-11ec-bb43-acde48001122 -version: 10 +version: 11 creation_date: '2021-11-17' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts. It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares. This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering. If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information. +description: |- + The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts. + It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares. + This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering. + If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information. data_source: - Windows Event Log Security 5145 -search: '`wineventlog_security` EventCode=5145 RelativeTargetName IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key") ObjectType=File ShareName IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") AccessMask= "0x2" | bucket _time span=5m | stats values(RelativeTargetName) as valRelativeTargetName, values(ShareName) as valShareName, values(ObjectType) as valObjectType, values(AccessMask) as valAccessmask, values(src_port) as valSrcPort, values(SourceAddress) as valSrcAddress count as numShareName by dest, _time, EventCode, src_user, src_ip | eventstats avg(numShareName) as avgShareName, stdev(numShareName) as stdShareName, count as numSlots by dest, _time, EventCode, src_user | eval upperThreshold=(avgShareName + stdShareName *3) | eval isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) | search isOutlier=1 | `high_frequency_copy_of_files_in_network_share_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. -known_false_positives: This behavior may seen in normal transfer of file within network if network share is common place for sharing documents. +search: |- + `wineventlog_security` + EventCode=5145 + RelativeTargetName IN ( + "*.7z", "*.bmp", "*.db", "*.doc", "*.docx", + "*.gif", "*.gz", "*.jpg", "*.key", "*.log", + "*.pdf", "*.png", "*.ppt", "*.pptx", "*.rar", + "*.rtf", "*.tar", "*.txt", "*.xls", "*.xlsx", "*.zip" + ) + ObjectType=File + ShareName IN ( + "\\\\*\\Admin$", + "\\\\*\\C$", + "\\\\*\\IPC$" + ) + | eval AccessMask_ = tonumber(AccessMask, 16) + + ``` + We Select only write-related operations: + 0x2 = WriteData (create/write file) + 0x4 = AppendData (append to file) + ``` + + | where (bit_and(AccessMask_, 2) != 0) OR (bit_and(AccessMask_, 4) != 0) + + | bucket _time span=5m + + ``` + Count write events per host, user and source IP within each time window + ``` + | stats + values(RelativeTargetName) AS valRelativeTargetName + values(ShareName) AS valShareName + values(ObjectType) AS valObjectType + values(AccessMask) AS valAccessMask + values(src_port) AS valSrcPort + values(SourceAddress) AS valSrcAddress + count AS numFileWriteEvents + BY dest _time EventCode src_user src_ip + + + ``` + Build a historical baseline for each destination host and user + using the average and standard deviation of previous buckets + ``` + + | eventstats + avg(numFileWriteEvents) AS avgFileWriteEvents + stdev(numFileWriteEvents) AS stdFileWriteEvents + count AS numSlots + BY dest EventCode src_user + + | eval upperThreshold=avgFileWriteEvents + (stdFileWriteEvents * 3) + | eval isOutlier=if( + numFileWriteEvents > 20 + AND ( + numSlots < 5 + OR numFileWriteEvents >= upperThreshold + ), + 1, + 0 + ) + | where isOutlier=1 + | `high_frequency_copy_of_files_in_network_share_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: |- + This behavior may be seen in normal transfer of files within a network if network shares are commonly used for sharing documents. references: - https://attack.mitre.org/techniques/T1537/ + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145#table-of-file-access-codes drilldown_searches: - name: View the detection results for - "$src_user$" search: '%original_detection_search% | search src_user = "$src_user$"' @@ -28,7 +98,7 @@ intermediate_findings: - field: src_user type: user score: 20 - message: High frequency copy of document into a network share from $src_ip$ by $src_user$ + message: High frequency copy of file [$valRelativeTargetName$] into a network share from [$src_ip$] by [$src_user$] threat_objects: - field: src_ip type: ip_address diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml index 0a21281d11..bb6f37b475 100644 --- a/detections/endpoint/network_share_discovery_via_dir_command.yml +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -1,19 +1,56 @@ name: Network Share Discovery Via Dir Command id: dc1457d0-1d9b-422e-b5a7-db46c184d9aa -version: 6 +version: 7 creation_date: '2023-05-23' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity. This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches. +description: |- + The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity. + This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution. + If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches. data_source: - Windows Event Log Security 5140 -search: '`wineventlog_security` EventCode=5140 ShareName IN("\\\\*\\ADMIN$","\\\\*\\C$","*\\\\*\\IPC$") AccessMask= 0x1 | stats min(_time) as firstTime max(_time) as lastTime count by ShareName IpAddress ObjectType SubjectUserName SubjectDomainName IpPort AccessMask Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_share_discovery_via_dir_command_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. -known_false_positives: System Administrators may use looks like net.exe or "dir commandline" for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list. +search: |- + `wineventlog_security` + EventCode=5140 + ShareName IN ( + "\\\\*\\Admin$", + "\\\\*\\C$", + "\\\\*\\IPC$" + ) + + + ``` + We select only read-related operations: + 0x1 = ReadData (or ListDirectory) + ``` + + | eval AccessMask_ = tonumber(AccessMask, 16) + | where (bit_and(AccessMask_, 1) != 0) + + | stats min(_time) as firstTime + max(_time) as lastTime + count + + by ShareName IpAddress ObjectType SubjectUserName + SubjectDomainName IpPort AccessMask Computer + + | rename Computer as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `network_share_discovery_via_dir_command_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: |- + System Administrators may use tools like "net.exe", "net1.exe", or "dir" for troubleshooting or administrations tasks. + However, this will typically come only from certain users and certain systems that can be added to an allow list. references: - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140#table-of-file-access-codes + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140 analytic_story: - IcedID asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index eb21ea6a7e..a9dbf0aa07 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -1,19 +1,56 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 -version: 14 +version: 15 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly -description: The following analytic detects suspicious registry modifications that disable the shutdown button on a user's logon screen. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with shutdown policies. This activity is significant because it is a tactic used by malware, particularly ransomware like KillDisk, to hinder system usability and prevent the removal of malicious changes. If confirmed malicious, this could impede system recovery efforts, making it difficult to restart the machine and remove other harmful modifications. +description: |- + The following analytic detects suspicious registry modifications that disable the shutdown button on a user's logon screen. + It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with shutdown policies. + This activity is significant because it is a tactic used by malware, particularly ransomware like KillDisk, to hinder system usability and prevent the removal of malicious changes. + If confirmed malicious, this could impede system recovery efforts, making it difficult to restart the machine and remove other harmful modifications. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_shutdown_button_through_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Registry WHERE + + ( + ( + Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" + Registry.registry_value_data = "0x00000000" + ) + OR + ( + Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" + Registry.registry_value_data = "0x00000001" + ) + ) + + by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status + Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_shutdown_button_through_registry_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. + If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 +known_false_positives: |- + This Windows feature may be implemented by an administrator on some servers where shutdown is restricted. + In that scenario, filtering by the machines and users allowed to modify this registry key is recommended. references: - - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/ + - https://github.com/redcanaryco/atomic-red-team/blob/1ba1dd8d9ce6f74700f7aec2e60de5632f667f03/atomics/T1112/T1112.md drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -28,7 +65,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Registry modification in "shutdownwithoutlogon" on $dest$ + message: The registry key [$registry_path$] was modified to disable the shutdown button on [$dest$]. analytic_story: - Ransomware - Windows Registry Abuse diff --git a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml index 00fda0fd2d..d09656e864 100644 --- a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml +++ b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml @@ -1,17 +1,43 @@ name: Windows Registry Dotnet ETW Disabled Via ENV Variable id: 55502381-5cce-491b-9277-7cb1d10bc0df -version: 10 +version: 11 creation_date: '2021-10-07' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Nasreddine Bencherchali, Splunk status: production type: TTP -description: The following analytic detects a registry modification that disables the ETW for the .NET Framework. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the COMPlus_ETWEnabled registry value under the "Environment" registry key path for both user (HKCU\Environment) and machine (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment) scopes. This activity is significant because disabling ETW can allow attackers to evade Endpoint Detection and Response (EDR) tools and hide their execution from audit logs. If confirmed malicious, this action could enable attackers to operate undetected, potentially leading to further compromise and persistent access within the environment. +description: |- + The following analytic detects a registry modification that disables the ETW for the .NET Framework. + It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the COMPlus_ETWEnabled registry value under the "Environment" registry key path for both user (HKCU\Environment) and machine (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment) scopes. + This activity is significant because disabling ETW can allow attackers to evade Endpoint Detection and Response (EDR) tools and hide their execution from audit logs. + If confirmed malicious, this action could enable attackers to operate undetected, potentially leading to further compromise and persistent access within the environment. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Environment*" Registry.registry_value_name="COMPlus_ETWEnabled" (Registry.registry_value_data=0x000000000 OR Registry.registry_value_data=0) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_dotnet_etw_disabled_via_env_variable_filter`' +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Registry WHERE + + Registry.registry_path="*\\Environment*" + Registry.registry_value_name="COMPlus_ETWEnabled" + Registry.registry_value_data IN ("0x00000000", "0") + + by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status + Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_registry_dotnet_etw_disabled_via_env_variable_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: Setting the "COMPlus_ETWEnabled" value as a global environment variable either in user or machine scope should only happens during debugging use cases, hence the false positives rate should be very minimal. +known_false_positives: |- + Setting the "COMPlus_ETWEnabled" value as a global environment variable either in user or machine scope should only happen during debugging use cases, hence the false positives rate should be very minimal. references: - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 - https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/ @@ -26,7 +52,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Modified registry entry $registry_path$ in $dest$ + title: The registry key [$registry_path$] with the value name [$registry_value_name$] was modified to the value [$registry_value_data$] to disable the ETW for the .NET Framework in [$dest$] entity: field: user type: user @@ -36,7 +62,7 @@ intermediate_findings: - field: dest type: system score: 50 - message: Modified registry entry $registry_path$ in $dest$ + message: The registry key [$registry_path$] with the value name [$registry_value_name$] was modified to the value [$registry_value_data$] to disable the ETW for the .NET Framework in [$dest$] analytic_story: - Windows Registry Abuse - Windows Defense Evasion Tactics diff --git a/detections/endpoint/windows_user_discovery_via_net.yml b/detections/endpoint/windows_user_discovery_via_net.yml index 50c542b21c..2aedf2608b 100644 --- a/detections/endpoint/windows_user_discovery_via_net.yml +++ b/detections/endpoint/windows_user_discovery_via_net.yml @@ -1,44 +1,62 @@ name: Windows User Discovery Via Net id: 7742987e-88c1-476b-a626-a869e088ab72 -version: 6 +version: 7 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Mauricio Velazco, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Hunting -description: The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` to query local user accounts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local users, which is a common step in situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further attacks, including privilege escalation and lateral movement within the network. +description: |- + The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` to query local and domain accounts. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local and domain users, which is a common step in situational awareness and Active Directory discovery. + If confirmed malicious, this behavior could lead to further attacks, including privilege escalation and lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE `process_net` (Processes.process="*user" - OR - Processes.process="*users" - OR - Processes.process="*users *" - OR - Processes.process="*user *") - AND - NOT (Processes.process="*/add" - OR - Processes.process="*/delete") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + `process_net` + + Processes.process IN ( + "*user *", + "*user", + "*users *", + "*users" + ) + NOT Processes.process IN ( + "*/add*", + "*/active*", + "*/delete*", + "*/times*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_discovery_via_net_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators or power users may use this command for troubleshooting. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1087/001/ + - https://attack.mitre.org/techniques/T1087/002/ + - https://ss64.com/nt/net-user.html + - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-user?source=recommendations#parameters analytic_story: - Active Directory Discovery - Sandworm Tools @@ -46,6 +64,7 @@ analytic_story: asset_type: Endpoint mitre_attack_id: - T1087.001 + - T1087.002 product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,9 +72,15 @@ product: category: endpoint security_domain: endpoint tests: - - name: True Positive Test + - name: True Positive Test - Local User Discovery attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit + - name: True Positive Test - Domain User Discovery + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From 51e5ed817447edff13054245a8838b9cfae8f694 Mon Sep 17 00:00:00 2001 From: p4t12ick <patrickbareiss1989@gmail.com> Date: Thu, 6 Aug 2026 10:42:25 +0200 Subject: [PATCH 061/164] Remove JS from ESCU (#4198) --------- Co-authored-by: P4T12ICK <pbareiss@splunk.com> --- app_template/default/data/ui/nav/default.xml | 8 ++-- .../default/data/ui/views/escu_summary.xml | 44 ++++++++++--------- .../default/data/ui/views/feedback.xml | 2 +- 3 files changed, 27 insertions(+), 27 deletions(-) diff --git a/app_template/default/data/ui/nav/default.xml b/app_template/default/data/ui/nav/default.xml index 87cd34acd6..6357d84701 100644 --- a/app_template/default/data/ui/nav/default.xml +++ b/app_template/default/data/ui/nav/default.xml @@ -1,10 +1,8 @@ <nav search_view="search" color="#65A637"> - <view name="landing" default="true"/> - <view name="onboarding"/> + <view name="escu_summary" default="true"/> + <view name="feedback"/> <view name="search"/> - <collection label="Dashboards"> - <view source="unclassified" match="__"/> - </collection> + <view name="dashboards"/> <a href="https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update">Docs</a> <a href="/app/SplunkEnterpriseSecuritySuite/ess_use_case_library">Explore in ES</a> </nav> diff --git a/app_template/default/data/ui/views/escu_summary.xml b/app_template/default/data/ui/views/escu_summary.xml index 31fd25f3d4..21c026c526 100644 --- a/app_template/default/data/ui/views/escu_summary.xml +++ b/app_template/default/data/ui/views/escu_summary.xml @@ -24,8 +24,8 @@ <html> <div style="background-color: #f8d7da; border: 1px solid #f5c6cb; border-radius: 5px; padding: 15px; margin-bottom: 20px;"> <h2 style="color: #721c24; margin: 0;"> - <i class="icon-info-circle" style="margin-right: 10px;"></i> - Explore Splunk Security Content using + <i class="icon-info-circle" style="margin-right: 10px;"/> + Explore Splunk Security Content using <a href="/app/SplunkEnterpriseSecuritySuite/ess_use_case_library" style="color: #721c24; text-decoration: underline;">Splunk Enterprise Security</a> </h2> </div> @@ -124,9 +124,9 @@ <chart> <search> <query> - | rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" -| spath input=action.correlationsearch.annotations path=mitre_attack{} output="MITRE Technique ID" -| spath input=action.correlationsearch.annotations path=analytic_story{} output=story_name + | rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" +| spath input=action.correlationsearch.annotations path=mitre_attack{} output="MITRE Technique ID" +| spath input=action.correlationsearch.annotations path=analytic_story{} output=story_name | stats dc(story_name) as "Analytic Stories" by "MITRE Technique ID" </query> </search> @@ -144,12 +144,12 @@ <label>Analytic Story</label> <choice value="*">All</choice> <search> - <latest>now</latest> - <query>| rest /services/configs/conf-savedsearches splunk_server=local count=0 -| search action.escu.search_type = detection -| spath input=action.correlationsearch.annotations path=analytic_story{} output="story" + <query>| rest /services/configs/conf-savedsearches splunk_server=local count=0 +| search title=ESCU* +| spath input=action.correlationsearch.annotations path=analytic_story{} output="story" | mvexpand story | dedup story | fields story</query> + <latest>now</latest> </search> <fieldForLabel>story</fieldForLabel> <fieldForValue>story</fieldForValue> @@ -164,19 +164,21 @@ <table> <title>Analytic Story Details - | rest /services/configs/conf-savedsearches splunk_server=local count=0 -| search action.escu.search_type = detection -| spath input=action.correlationsearch.annotations path=analytic_story{} output="analytic_story" -| spath input=action.correlationsearch.annotations path=mitre_attack{} output="mitre_attack" -| spath input=action.escu.data_models path={} output="Data Models" -| rename title as "Detections" -| join analytic_story - [| rest /services/configs/conf-analyticstories splunk_server=local count=0 - | search title="analytic_story://*" - | eval "analytic_story"=replace(title,"analytic_story://","" ) - ] + | rest /services/configs/conf-savedsearches splunk_server=local count=0 +| search title=ESCU* +| spath input=action.correlationsearch.annotations path=analytic_story{} output="analytic_story" +| spath input=action.correlationsearch.annotations path=mitre_attack{} output="mitre_attack" +| rename title as "Detections" +| join analytic_story + [| rest /services/configs/conf-analyticstories splunk_server=local count=0 + | search title="analytic_story://*" + | eval "analytic_story"=replace(title,"analytic_story://","" ) + ] | search analytic_story= $story$ -|stats values(Detections) as Detections values(mitre_attack) as "MITRE Technique ID" values(last_updated) as "Last Updated" by analytic_story description| rename analytic_story as "Analytic Story"| rename description as Description| table "Analytic Story" Description Detections "MITRE Technique ID" "Last Updated" +| stats values(Detections) as Detections values(mitre_attack) as "MITRE Technique ID" values(last_updated) as "Last Updated" by analytic_story description +| rename analytic_story as "Analytic Story" +| rename description as Description +| table "Analytic Story" Description Detections "MITRE Technique ID" "Last Updated" $earliest$ $latest$ diff --git a/app_template/default/data/ui/views/feedback.xml b/app_template/default/data/ui/views/feedback.xml index ffc5a44def..6088037ed2 100644 --- a/app_template/default/data/ui/views/feedback.xml +++ b/app_template/default/data/ui/views/feedback.xml @@ -4,7 +4,7 @@ - You can contact the Splunk Threat Research team atresearch@splunk.com to send us support requests, bug reports, and questions. + You can contact the Splunk Threat Research team at research@splunk.com to send us support requests, bug reports, and questions.
Specify the request type and the title of any related analytic stories, detections analytics where applicable.
You can also find us on the #es-content-updates Splunk Community Slack channel. From 647618c6e00606f7d045004095671e80fe58ac6d Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Fri, 7 Aug 2026 09:46:16 -0400 Subject: [PATCH 062/164] Snapattack Linux Conversions (#4173) --------- Co-authored-by: Nasreddine Bencherchali --- ..._executed_from_shared_memory_directory.yml | 90 +++++++++++++++ .../linux_efi_bootloader_file_deletion.yml | 78 +++++++++++++ ...creation_in_system_generator_directory.yml | 74 ++++++++++++ .../linux_ghostscript_exploitation.yml | 93 +++++++++++++++ .../endpoint/linux_motd_script_added.yml | 78 +++++++++++++ .../linux_netcat_outbound_connection.yml | 79 +++++++++++++ ...linux_possible_bootloader_modification.yml | 107 ++++++++++++++++++ ...inux_possible_gsm_privilege_escalation.yml | 89 +++++++++++++++ ...ossible_nimbuspwn_privilege_escalation.yml | 84 ++++++++++++++ ...le_privilege_escalation_via_pythonpath.yml | 79 +++++++++++++ .../linux_possible_system_binary_backdoor.yml | 84 ++++++++++++++ .../endpoint/linux_root_execution_of_id.yml | 83 ++++++++++++++ ...istory_access_via_command_line_utility.yml | 102 +++++++++++++++++ ...inux_shell_pseudo_device_reverse_shell.yml | 97 ++++++++++++++++ ...suspicious_child_process_of_postgresql.yml | 102 +++++++++++++++++ ...picious_docker_build_command_execution.yml | 85 ++++++++++++++ ...invocation_building_init_shared_object.yml | 93 +++++++++++++++ ...picious_privileged_container_execution.yml | 83 ++++++++++++++ .../linux_suspicious_redis_activity.yml | 100 ++++++++++++++++ ...ious_staging_of_alternate_system_files.yml | 88 ++++++++++++++ .../linux_suspicious_xdg_autostart.yml | 81 +++++++++++++ .../endpoint/linux_udev_rule_created.yml | 78 +++++++++++++ .../endpoint/linux_usermod_root_uid_set.yml | 79 +++++++++++++ 23 files changed, 2006 insertions(+) create mode 100644 detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml create mode 100644 detections/endpoint/linux_efi_bootloader_file_deletion.yml create mode 100644 detections/endpoint/linux_file_creation_in_system_generator_directory.yml create mode 100644 detections/endpoint/linux_ghostscript_exploitation.yml create mode 100644 detections/endpoint/linux_motd_script_added.yml create mode 100644 detections/endpoint/linux_netcat_outbound_connection.yml create mode 100644 detections/endpoint/linux_possible_bootloader_modification.yml create mode 100644 detections/endpoint/linux_possible_gsm_privilege_escalation.yml create mode 100644 detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml create mode 100644 detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml create mode 100644 detections/endpoint/linux_possible_system_binary_backdoor.yml create mode 100644 detections/endpoint/linux_root_execution_of_id.yml create mode 100644 detections/endpoint/linux_shell_history_access_via_command_line_utility.yml create mode 100644 detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml create mode 100644 detections/endpoint/linux_suspicious_child_process_of_postgresql.yml create mode 100644 detections/endpoint/linux_suspicious_docker_build_command_execution.yml create mode 100644 detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml create mode 100644 detections/endpoint/linux_suspicious_privileged_container_execution.yml create mode 100644 detections/endpoint/linux_suspicious_redis_activity.yml create mode 100644 detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml create mode 100644 detections/endpoint/linux_suspicious_xdg_autostart.yml create mode 100644 detections/endpoint/linux_udev_rule_created.yml create mode 100644 detections/endpoint/linux_usermod_root_uid_set.yml diff --git a/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml b/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml new file mode 100644 index 0000000000..d8207546a9 --- /dev/null +++ b/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml @@ -0,0 +1,90 @@ +name: Linux Binary Executed from Shared Memory Directory +id: 2e954190-d547-447c-94d7-d8acac97873b +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies the execution of a binary by root from Linux shared memory directories (/dev/shm/ and /run/shm/). Threat actors place executables in these directories to persist on high-uptime servers as system backdoors. Both /dev/shm and /run/shm are tmpfs-backed directories that exist only in virtual memory with no persistent storage, making them attractive for staging fileless or semi-fileless malware while avoiding disk forensics. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_path IN ( + "/dev/shm/*", + "/run/shm/*" + ) + Processes.user=root + + by Processes.process Processes.process_path Processes.process_name Processes.user + Processes.user_id Processes.process_hash Processes.parent_process_name + Processes.parent_process_path Processes.parent_process Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid Processes.process_id + Processes.vendor_product Processes.action Processes.dest + Processes.process_current_directory Processes.process_integrity_level + Processes.original_file_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_binary_executed_from_shared_memory_directory_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate applications may use shared memory directories for temporary file storage or inter-process communication. Verify any flagged activity against known software behavior and filter accordingly. +references: + - https://linuxsecurity.com/features/fileless-malware-on-linux + - https://twitter.com/GossiTheDog/status/1522964028284411907 + - https://github.com/elastic/detection-rules/blob/main/rules/linux/execution_process_started_in_shared_memory_directory.toml +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Linux binary executed from shared memory directory [$process$] - activity observed on [$dest$]. + - field: user + type: user + score: 20 + message: Linux binary executed from shared memory directory [$process$] - activity observed on [$dest$]. +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation + - Linux Persistence Techniques + - Linux Privilege Escalation + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_efi_bootloader_file_deletion.yml b/detections/endpoint/linux_efi_bootloader_file_deletion.yml new file mode 100644 index 0000000000..347040e3ba --- /dev/null +++ b/detections/endpoint/linux_efi_bootloader_file_deletion.yml @@ -0,0 +1,78 @@ +name: Linux EFI Bootloader File Deletion +id: 818a63f8-f2e1-4d1b-ac95-3a4f2ec7f113 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects file deletions in the EFI boot directory. These files are responsible for initializing the Boot Manager during system startup. Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.action="deleted" + Filesystem.file_path="/boot/efi/EFI/BOOT/*" + Filesystem.file_name="*.efi*" + + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid Filesystem.process_id + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_efi_bootloader_file_deletion_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file deletion events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or package managers may delete or replace EFI bootloader files during system updates or OS reinstallation. Filter for known maintenance windows and authorized administrative activity. +references: + - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/ + - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux EFI bootloader [$file_name$] deletion detected on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Data Destruction + - Linux Persistence Techniques + - Ransomware +asset_type: Endpoint +cve: + - CVE-2024-7344 +mitre_attack_id: + - T1542.001 + - T1542.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_file_creation_in_system_generator_directory.yml b/detections/endpoint/linux_file_creation_in_system_generator_directory.yml new file mode 100644 index 0000000000..0cde3fae98 --- /dev/null +++ b/detections/endpoint/linux_file_creation_in_system_generator_directory.yml @@ -0,0 +1,74 @@ +name: Linux File Creation In System Generator Directory +id: 06c23568-e05b-4fff-95cd-8b0303b6d032 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects potential persistence using a systemd generator on Linux, which involves creating a malicious script or binary that is typically executed during the system's boot process. + Systemd generators are typically placed in directories like /lib/systemd/system-generators/, where they are run early in the boot sequence to dynamically generate or modify unit files that control system services. + By placing a custom generator in this directory, an attacker can ensure their code is executed each time the system starts, allowing them to maintain access or control even after reboots. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created", "modified") + Filesystem.file_path="*/lib/systemd/system-generators/*" + + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid Filesystem.process_id + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_file_creation_in_system_generator_directory_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or software packages may place custom generators in systemd generator directories during system configuration or application deployment. Filter based on known software installations and verified administrative activity. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The file [$file_name$] was created in the system generator directory [$file_path$] on [$dest$] by [$user$]. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1037.005 + - T1547 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_ghostscript_exploitation.yml b/detections/endpoint/linux_ghostscript_exploitation.yml new file mode 100644 index 0000000000..39c1533e18 --- /dev/null +++ b/detections/endpoint/linux_ghostscript_exploitation.yml @@ -0,0 +1,93 @@ +name: Linux Ghostscript Exploitation +id: 580f99d8-a4c8-4ef1-9c84-f355867bca41 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects exploitation of Ghostscript causing command execution. + This can be used by attackers to abuse file conversion services or embedded LibreOffice documents. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_path IN ( + "*/gs", + "*/ghostscript" + ) + Processes.process="sh -c*" + + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name + Processes.parent_process_exec Processes.action Processes.dest + Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name + Processes.parent_process Processes.parent_process_path + Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user + Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_ghostscript_exploitation_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate use of Ghostscript for document processing or file conversion tasks may trigger this rule. Filter based on known authorized applications that rely on Ghostscript for routine document handling. +references: + - https://www.bleepingcomputer.com/news/security/rce-bug-in-widely-used-ghostscript-library-now-exploited-in-attacks/ + - https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux Ghostscript exploitation identified via [$process$] by [$user$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation + - Unusual Processes + - Suspicious Command-Line Executions + - Linux Living Off The Land +asset_type: Endpoint +cve: + - CVE-2024-29510 +mitre_attack_id: + - T1204.002 + - T1566 + - T1059 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_motd_script_added.yml b/detections/endpoint/linux_motd_script_added.yml new file mode 100644 index 0000000000..262b5ce7aa --- /dev/null +++ b/detections/endpoint/linux_motd_script_added.yml @@ -0,0 +1,78 @@ +name: Linux MOTD Script Added +id: 6dd14256-559b-4364-99d8-0968407b8074 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of a file within the /etc/update-motd.d directory. + This is used to add scripts that run with Message of the Day (MOTD) when a user logs in. + This can be used by attackers for persistence if it contains malicious code. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.file_path="/etc/update-motd.d/*" + Filesystem.action IN ("created", "modified") + + by Filesystem.file_path Filesystem.file_name + Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid + Filesystem.process_id + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_motd_script_added_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators may add or modify MOTD scripts for valid operational purposes such as displaying system information or login banners. Filter based on known administrative activity and authorized users. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential MOTD Script [$file_name$] added by [$user$] on [$dest$]. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques + - Linux Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1547 + - T1037 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_netcat_outbound_connection.yml b/detections/endpoint/linux_netcat_outbound_connection.yml new file mode 100644 index 0000000000..30ddef8070 --- /dev/null +++ b/detections/endpoint/linux_netcat_outbound_connection.yml @@ -0,0 +1,79 @@ +name: Linux Netcat Outbound Connection +id: 50a9de97-d58d-4844-8daf-928d2faceead +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects outbound network connections originating from Netcat or Netcat-like binaries on Linux systems. + Netcat is a versatile networking utility that, while legitimate in some contexts, is frequently abused by attackers to establish reverse shells, exfiltrate data, or create persistent backdoor connections to remote systems. + This activity is significant because outbound connections from these binaries often indicate an active compromise, where an attacker may be maintaining command-and-control communication or tunneling malicious traffic. + If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system. +data_source: + - Sysmon EventID 3 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Network_Traffic.All_Traffic where + + All_Traffic.app IN ( + "*nc", + "*ncat", + "*netcat" + ) + All_Traffic.direction="outbound" + + by All_Traffic.src All_Traffic.dest All_Traffic.dest_port All_Traffic.transport + All_Traffic.process_name All_Traffic.app All_Traffic.user All_Traffic.process_id + + | `drop_dm_object_name(All_Traffic)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_netcat_outbound_connection_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain network connection events including the source, destination, port, and process context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Network_Traffic` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or developers may use netcat for troubleshooting, port scanning, or testing network connectivity. Filter based on known administrative activity or authorized users. +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Netcat outbound connection detected on [$dest$] +threat_objects: + - field: dest + type: ip_address +analytic_story: + - Linux Post-Exploitation + - Command And Control + - Data Exfiltration + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_bootloader_modification.yml b/detections/endpoint/linux_possible_bootloader_modification.yml new file mode 100644 index 0000000000..d1ecc96baf --- /dev/null +++ b/detections/endpoint/linux_possible_bootloader_modification.yml @@ -0,0 +1,107 @@ +name: Linux Possible Bootloader Modification +id: 97fd4330-bd47-4742-abaf-c877d404822a +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects processes modifying data in the EFI volume on Linux. + These files are responsible for initializing the Boot Manager during system startup. + Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + ( + Processes.process_name IN ( + "cp", + "mv", + "ln", + ) + Processes.process_current_directory="*/EFI/BOOT*" + ) + OR + ( + Processes.process="*/EFI/BOOT*" + NOT Processes.process_name IN ( + "ls", + "grep", + "egrep", + ) + ) + + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_bootloader_modification_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or package managers such as grub or shim may modify EFI volume files during OS upgrades or bootloader updates. Filter based on known update processes or trusted administrative activity. +references: + - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/ + - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Possible bootloader modification identified via [$process$] by [$user$] on [$dest$] + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Possible bootloader modification via [$process$] by [$user$] on [$dest$]. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Rootkit + - Data Destruction + - Linux Persistence Techniques +asset_type: Endpoint +cve: + - CVE-2024-7344 +mitre_attack_id: + - T1542.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_gsm_privilege_escalation.yml b/detections/endpoint/linux_possible_gsm_privilege_escalation.yml new file mode 100644 index 0000000000..8ff50d0093 --- /dev/null +++ b/detections/endpoint/linux_possible_gsm_privilege_escalation.yml @@ -0,0 +1,89 @@ +name: Linux Possible GSM Privilege Escalation +id: ae13064b-72ea-41fb-9d29-716c27e01208 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the commands used in a race condition found in the GSM 0710 tty multiplexor in the Linux kernel. + This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled. + This could allow a local unprivileged user to escalate their privileges on the system. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process="*rmmod *" + Processes.process="*n_gsm*" + Processes.process="*exec *" + Processes.process IN ( + "*/bin/bash*", + "*/bin/dash*", + "*/bin/sh*", + "*/bin/zsh*" + ) + + by Processes.process Processes.vendor_product + Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_gsm_privilege_escalation_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators or developers testing GSM multiplexor configurations may trigger this detection. Filter based on known authorized users or testing environments. +references: + - https://access.redhat.com/security/cve/cve-2023-6546 + - https://github.com/Nassim-Asrir/ZDI-24-020/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential GSM Privilege Escalation via [$process$] by [$user$] on [$dest$]. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2023-6546 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml b/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml new file mode 100644 index 0000000000..42c1670ce6 --- /dev/null +++ b/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml @@ -0,0 +1,84 @@ +name: Linux Possible Nimbuspwn Privilege Escalation +id: 24a540b7-6eec-4972-ad85-1f2232f9a849 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects directory traversal attempts associated with Nimbuspwn, a Linux privilege escalation vulnerability affecting the networkd-dispatcher service. + Nimbuspwn exploits weaknesses in the networkd-dispatcher service to traverse directories and execute arbitrary code with elevated privileges. + If confirmed malicious, this activity could allow an attacker to escalate privileges to root, potentially leading to full system compromise, persistent unauthorized access, and the ability to deploy additional malicious payloads. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process="*networkd-dispatcher*" + Processes.process="*../*" + + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_nimbuspwn_privilege_escalation_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system processes or administrative scripts that traverse directories in a similar pattern may trigger this detection. Filter based on known administrative activity and verified system processes. +references: + - https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Possible Nimbuspwn privilege escalation via [$process$] by [$user$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Post-Exploitation +asset_type: Endpoint +cve: + - CVE-2022-29799 + - CVE-2022-29800 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml new file mode 100644 index 0000000000..44dfa16e20 --- /dev/null +++ b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml @@ -0,0 +1,79 @@ +name: Linux Possible Privilege Escalation via PYTHONPATH +id: 5edda575-409a-4820-a048-5780796a181e +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects the creation of a malicious shared object at a Python importlib path outside the standard system library directories, a technique used to abuse PYTHONPATH for local privilege escalation. + Attackers exploiting vulnerabilities such as the 2024 NeedRestart flaw (CVE-2024-48990) plant a crafted importlib/__init__.so in an attacker-controlled directory, then manipulate the PYTHONPATH environment variable so that a privileged process, such as NeedRestart running as root, loads the rogue module instead of the legitimate one, achieving code execution with elevated privileges. + The detection monitors for file writes matching the importlib/__init__.so pattern that do not originate from expected system library paths. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.file_path="*/importlib/__init__.so*" + NOT Filesystem.file_path="*/lib/*" + + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.process_guid Filesystem.process_id + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_privilege_escalation_via_pythonpath_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate Python developers or system administrators may modify PYTHONPATH for testing or application configuration purposes. Filter based on known development environments and trusted user activity. +references: + - https://www.bleepingcomputer.com/news/security/ubuntu-linux-impacted-by-decade-old-needrestart-flaw-that-gives-root/ + - https://www.qualys.com/2024/11/19/needrestart/needrestart.txt +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Possible Privilege Escalation via PYTHONPATH via [$file_name$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +cve: + - CVE-2024-48990 +mitre_attack_id: + - T1068 + - T1574.007 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_system_binary_backdoor.yml b/detections/endpoint/linux_possible_system_binary_backdoor.yml new file mode 100644 index 0000000000..5ee3b287d4 --- /dev/null +++ b/detections/endpoint/linux_possible_system_binary_backdoor.yml @@ -0,0 +1,84 @@ +name: Linux Possible System Binary Backdoor +id: a806d611-ea81-4d8a-9b9b-fbf5b6ec520a +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation or overwrite of commonly targeted Linux system binaries such as cat, ls, cp, ps, mv, netstat, ss, and lsof. + Adversaries may replace these utilities with backdoored versions to hide malicious activity, harvest credentials, or maintain persistence while appearing to use legitimate system tools. + This technique is associated with rootkit deployment and post-exploitation frameworks such as PANIX. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.file_path IN ( + "/usr/bin/cat", + "/usr/bin/cp", + "/usr/bin/ls", + "/usr/bin/lsof", + "/usr/bin/mv", + "/usr/bin/netstat", + "/usr/bin/ps", + "/usr/bin/ss" + ) + + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid Filesystem.process_id + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_system_binary_backdoor_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system updates or package managers may create or overwrite system binaries during normal operations. Filter for known update processes and package management activity to reduce noise. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Possible System Binary Backdoor activity observed on [$dest$]. System binary [$file_name$] was created or overwritten by [$user$]. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Post-Exploitation + - Linux Persistence Techniques + - Linux Privilege Escalation + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1036 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_root_execution_of_id.yml b/detections/endpoint/linux_root_execution_of_id.yml new file mode 100644 index 0000000000..47cb6b158b --- /dev/null +++ b/detections/endpoint/linux_root_execution_of_id.yml @@ -0,0 +1,83 @@ +name: Linux Root Execution of id +id: 538dc501-ce3a-4a32-9f56-6dbe0aee1474 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the execution of the `id` command by the root user on Linux systems. Attackers commonly run `id` during post-exploitation to confirm they have achieved root-level privileges after a privilege escalation attempt. + This activity is significant because it may indicate an attacker is verifying superuser access following a successful compromise. + If confirmed malicious, this could signal that an attacker has gained full control of the system, enabling them to perform destructive actions, exfiltrate sensitive data, or establish persistent unauthorized access. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_path="/usr/bin/id" + Processes.user="root" + + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_root_execution_of_id_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrators and automated scripts routinely run the id command as root for system auditing or configuration tasks. Filter based on known administrative activity or trusted scripts. +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Execution of [$process_path$] by [$user$] on [$dest$] + - field: user + type: user + score: 20 + message: Execution of [$process_path$] by [$user$] on [$dest$] +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Linux Privilege Escalation + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1033 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_shell_history_access_via_command_line_utility.yml b/detections/endpoint/linux_shell_history_access_via_command_line_utility.yml new file mode 100644 index 0000000000..15010e2008 --- /dev/null +++ b/detections/endpoint/linux_shell_history_access_via_command_line_utility.yml @@ -0,0 +1,102 @@ +name: Linux Shell History Access Via Command Line Utility +id: 0e4c2544-b27a-4a2d-b9be-cac8efe515fb +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects attempts to read shell history files (bash, zsh, fish, etc.). + A history file is a log file that records all the commands executed in a shell on a Linux or Unix-based operating system. + A malicious actor who gains access to a user's shell history file can potentially obtain sensitive information and use it to compromise the user's system and data. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name IN ( + "cat", + "fmt", + "head", + "less", + "more", + "nano", + "sort", + "tail", + "uniq", + "vi", + "vim" + ) + Processes.process IN ( + "*.bash_history*", + "*.history*", + "*.sh_history*", + "*.zhistory*", + "*.zsh_history*", + "*fish_history*" + ) + + by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash + Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest + Processes.process_current_directory Processes.process_path Processes.process_integrity_level + Processes.original_file_name Processes.parent_process Processes.parent_process_path + Processes.parent_process_guid Processes.parent_process_id Processes.process_guid + Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_shell_history_access_via_command_line_utility_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators and automated scripts may access shell history files for auditing or troubleshooting purposes. Filter based on known administrative accounts and approved tooling in your environment. +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential shell history access [$process$] by [$user$] on [$dest$] via [$process_name$]. + - field: user + type: user + score: 20 + message: Potential shell history access [$process$] by [$user$] on [$dest$] via [$process_name$]. +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Compromised Linux Host + - Linux Privilege Escalation + - Linux Persistence Techniques + - Credential Dumping +asset_type: Endpoint +mitre_attack_id: + - T1552.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml b/detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml new file mode 100644 index 0000000000..b53c890037 --- /dev/null +++ b/detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml @@ -0,0 +1,97 @@ +name: Linux Shell Pseudo Device Reverse Shell +id: f324bc06-8436-4606-8882-0a8fb480b719 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the use of shell's /dev/tcp or /dev/udp pseudo-device feature to establish outbound network connections. + This special file system interface allows opening a network socket and sending or receiving data using simple shell commands. + Attackers commonly abuse this native shell capability to create reverse shells without requiring external tools such as netcat, by redirecting shell I/O over a TCP or UDP connection to an attacker-controlled host and port. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name IN ( + "bash", + "dash", + "sh", + "zsh" + ) + Processes.process IN ( + "*/dev/tcp/*", + "*/dev/udp/*" + ) + + by Processes.process Processes.vendor_product + Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + |`linux_shell_pseudo_device_reverse_shell_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or developers may use /dev/tcp or /dev/udp for network diagnostics or testing purposes. + Filter based on known authorized users and trusted source systems. +references: + - https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/#bash-tcp +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential reverse shell [$process$] by [$user$] on [$dest$] via [$process_name$]. + - field: user + type: user + score: 20 + message: Potential reverse shell [$process$] by [$user$] on [$dest$] via [$process_name$]. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Linux Persistence Techniques + - Linux Privilege Escalation + - Command And Control + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1048.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml b/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml new file mode 100644 index 0000000000..4280518679 --- /dev/null +++ b/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml @@ -0,0 +1,102 @@ +name: Linux Suspicious Child Process of PostgreSQL +id: 6488b83f-8e76-43c3-91ee-c90a6d9e8d62 +version: 1 +creation_date: '2026-07-17' +modification_date: '2026-07-17' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects PostgreSQL spawning a shell, interpreter, or network utility as a child process. + When an attacker exploits a remote code execution vulnerability in PostgreSQL (such as via malicious COPY TO/FROM PROGRAM, CVE-2019-9193, or an insecurely configured extension), the database process itself becomes the parent of attacker-controlled commands. + Legitimate PostgreSQL processes do not normally fork shells or download tools, making this a high-fidelity signal for post-exploitation activity. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.parent_process_name IN ( + "postgres", + "postmaster", + "pg_ctl" + ) + OR + Processes.parent_process_path = "*/bin/postgres" + OR + Processes.process_current_directory="*/var/lib/postgresql/*/main*" + ) + Processes.process_name IN ( + "awk", "bash", "curl", "dash", "env", "gawk", "id", "ifconfig", + "ksh", "lua", "nc", "ncat", "netcat", "nmap", "openssl", "perl", + "php", "python", "python2", "python3", "ruby", "sh", "socat", + "tcpdump", "wget", "whoami", "zsh" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_child_process_of_postgresql_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Custom PostgreSQL extensions or wrapper scripts that legitimately invoke shell utilities may trigger this detection. Baseline the environment and use the filter macro to suppress known-good parent/child combinations. Recommend throttling by dest and process_name before enabling broadly. +references: + - https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/ + - https://www.postgresql.org/docs/current/sql-copy.html + - https://nvd.nist.gov/vuln/detail/CVE-2019-9193 +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Suspicious Child Process of [$parent_process_path$] identified on [$dest$] via [$process_name$] with the Command Line [$process$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation + - Linux Privilege Escalation + - Linux Persistence Techniques + - Compromised Linux Host + - SQL Injection +asset_type: Endpoint +mitre_attack_id: + - T1190 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_docker_build_command_execution.yml b/detections/endpoint/linux_suspicious_docker_build_command_execution.yml new file mode 100644 index 0000000000..643adc6931 --- /dev/null +++ b/detections/endpoint/linux_suspicious_docker_build_command_execution.yml @@ -0,0 +1,85 @@ +name: Linux Suspicious Docker Build Command Execution +id: dc4a58d2-fde3-4bdd-a36b-7368b2523589 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects docker build being executed on Dockerfiles within the /tmp directory. + This is not a typical location for this activity and can indicate an actor adding a container for malicious future actions. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process="*docker*" + Processes.process="*build*" + ( + ( + Processes.process="*-f *" + Processes.process="* /tmp*" + ) + OR + Processes.process_current_directory="/tmp*" + ) + + by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash + Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest + Processes.process_current_directory Processes.process_path Processes.process_integrity_level + Processes.original_file_name Processes.parent_process Processes.parent_process_path + Processes.parent_process_guid Processes.parent_process_id Processes.process_guid + Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_docker_build_command_execution_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Developers or administrators may occasionally use the /tmp directory for testing Docker builds in non-production environments. Filter based on known users or systems where this activity has been approved. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Docker Build Command [$process$] observed on [$dest$] executed by [$user$]. +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1610 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml b/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml new file mode 100644 index 0000000000..321a5f1d9e --- /dev/null +++ b/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml @@ -0,0 +1,93 @@ +name: Linux Suspicious GCC Invocation Building Init Shared Object +id: 9dbf4a61-0493-43bd-932c-532ba7671a7a +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name IN ( + "*x86_64-linux-gnu-gcc*", + "cc", + "g++", + "gcc-*", + "gcc" + ) + Processes.process="*-shared*" + Processes.process="*-Wl,-init,*" + Processes.process="*.so*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_gcc_invocation_building_init_shared_object_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate developers may use these GCC flags when building shared libraries that require initialization functions. Filter based on known development environments and trusted users. +references: + - https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/ + - https://github.com/pr0v3rbs/CVE-2025-32463_chwoot +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Suspicious GCC Invocation Building Init Shared Object identified on [$dest$] via [$process_name$] with the Command Line [$process$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +cve: + - CVE-2025-32463 +mitre_attack_id: + - T1129 + - T1068 + - T1608 + - T1027.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_privileged_container_execution.yml b/detections/endpoint/linux_suspicious_privileged_container_execution.yml new file mode 100644 index 0000000000..7bacb3256d --- /dev/null +++ b/detections/endpoint/linux_suspicious_privileged_container_execution.yml @@ -0,0 +1,83 @@ +name: Linux Suspicious Privileged Container Execution +id: 29b888db-d6e7-4286-bbf5-39d9f260444c +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the execution of a Docker container with the privileged flag set, or with the pid namespace set to the host. + This can indicate a container running with elevated permissions and access to the underlying system. Actors can hide containers such as this to enable persistent access. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process="*docker *" + Processes.process="* run*" + Processes.process IN ("*--privileged*", "*--pid=host*") + + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name + Processes.parent_process_exec Processes.action Processes.dest Processes.process_current_directory + Processes.process_path Processes.process_integrity_level Processes.original_file_name + Processes.parent_process Processes.parent_process_path Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user + Processes.process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_privileged_container_execution_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators may intentionally run privileged containers for maintenance, debugging, or specific infrastructure tasks. Filter based on known approved workflows and trusted administrative users. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Privileged Container identified on [$dest$] via [$process_name$] with the Command Line [$process$]. +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation + - Linux Privilege Escalation + - Linux Persistence Techniques + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1610 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_redis_activity.yml b/detections/endpoint/linux_suspicious_redis_activity.yml new file mode 100644 index 0000000000..9efe94050d --- /dev/null +++ b/detections/endpoint/linux_suspicious_redis_activity.yml @@ -0,0 +1,100 @@ +name: Linux Suspicious Redis Activity +id: 098bbfa8-a591-44ab-9ec0-ae8ee82b4450 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects Redis processes spawning a system shell command. This can indicate exploitation activity of a redis server to gain code execution. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.parent_process_name IN ( + "redis-sentinel", + "redis-server" + ) + OR + Processes.parent_process_path = "*/bin/redis*" + ) + + Processes.process_name IN ( + "awk", "bash", "curl", "dash", "gawk", "id", "ifconfig", + "lua", "nc", "ncat", "netcat", "openssl", "perl", "php", + "python", "python2", "python3", "ruby", "sh", "socat", + "wget", "whoami", "zsh" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_redis_activity_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate administrative scripts or automated maintenance tasks may trigger this detection when managing Redis configurations or performing system operations. Filter based on known administrative activity and approved management tools. +references: + - https://thesecmaster.com/how-to-fix-cve-2022-0543-a-critical-lua-sandbox-escape-vulnerability-in-redis/ + - https://www.bleepingcomputer.com/news/security/new-p2pinfect-worm-malware-targets-linux-and-windows-redis-servers/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Suspicious Redis Activity identified on [$dest$] via [$process_name$] with the Command Line [$process$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation + - Compromised Linux Host + - Linux Persistence Techniques + - Linux Privilege Escalation + - Linux Living Off The Land + - Command And Control +asset_type: Endpoint +cve: + - CVE-2022-0543 +mitre_attack_id: + - T1505 + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml b/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml new file mode 100644 index 0000000000..028d14ace5 --- /dev/null +++ b/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml @@ -0,0 +1,88 @@ +name: Linux Suspicious Staging of Alternate System Files +id: 250fd1b5-e62a-4515-baff-3010b52b4c12 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of sensitive system files such as nsswitch.conf, passwd, shadow, sudoers, and NSS shared libraries outside of their canonical /etc or /var/lib/docker paths. + This technique is associated with CVE-2025-32463 (chwoot), where an attacker stages a fake root directory containing spoofed system configuration files and NSS libraries to manipulate how privileged processes such as sudo resolve name services, enabling local privilege escalation by hijacking library loading without modifying the real /etc directory. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.file_path IN ( + "*/etc/group", + "*/etc/nsswitch.conf", + "*/etc/pam.conf", + "*/etc/passwd", + "*/etc/shadow", + "*/etc/sudo.conf", + "*/etc/sudoers", + "*/libnss_*" + ) + NOT Filesystem.file_path IN ( + "/etc/*", + "/var/lib/docker/*" + ) + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_staging_of_alternate_system_files_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Developers or system administrators may stage alternate system files for legitimate testing or containerized environments. Filter based on known development or testing systems. +references: + - https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/ + - https://github.com/pr0v3rbs/CVE-2025-32463_chwoot +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Staging of Alternate System File - [$file_name$] observed on [$dest$]. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1036 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_xdg_autostart.yml b/detections/endpoint/linux_suspicious_xdg_autostart.yml new file mode 100644 index 0000000000..02002b9513 --- /dev/null +++ b/detections/endpoint/linux_suspicious_xdg_autostart.yml @@ -0,0 +1,81 @@ +name: Linux Suspicious XDG Autostart +id: dc057fd6-34db-4c41-b8dd-00463c47bf83 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of a .desktop file within XDG autostart directories, including the system-wide /etc/xdg/autostart and user-local ~/.config/autostart paths. + Adversaries abuse XDG autostart entries to achieve persistence on Linux desktop environments — any .desktop file placed in these directories is automatically executed when a user logs into a graphical session. + This technique is used by post-exploitation frameworks such as PANIX to survive reboots without requiring root on user-local paths, or to achieve system-wide persistence when writing to /etc/xdg/autostart. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.action="created" + Filesystem.file_path IN ( + "/etc/xdg/autostart/*", + "*/.config/autostart/*" + ) + Filesystem.file_path = "*.desktop" + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_xdg_autostart_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate software installations may create .desktop files in /etc/xdg/autostart as part of their normal setup process. Filter known software deployment tools and approved administrative activity as needed. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Possible Suspicious XDG Autostart file created under [$file_path$] by [$user$] on [$dest$] +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques + - Linux Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1547 + - T1037 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_udev_rule_created.yml b/detections/endpoint/linux_udev_rule_created.yml new file mode 100644 index 0000000000..d2bb67607d --- /dev/null +++ b/detections/endpoint/linux_udev_rule_created.yml @@ -0,0 +1,78 @@ +name: Linux UDEV Rule Created +id: 94d0e307-beae-4f85-8150-69c169b979c1 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of files within udev rules directories, including /etc/udev/rules.d and /usr/lib/udev/rules.d. Adversaries abuse udev rules to achieve persistent code execution by embedding RUN+= directives that trigger arbitrary commands whenever a matching device event occurs, such as a USB device being connected or a network interface coming online. Because udev rules execute in the context of the udev daemon with elevated privileges, this technique can provide both persistence and privilege escalation. It is used by post-exploitation frameworks such as PANIX and is effective on headless servers where device events still fire despite no interactive user session. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.file_path IN ( + "/etc/udev/rules.d/*", + "/usr/lib/udev/rules.d/*" + ) + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_udev_rule_created_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or software installers may create udev rules as part of normal hardware configuration or device management tasks. Filter based on known administrative activity and trusted software installations. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: New UDEV rule created under [$file_path$] by [$user$] on [$dest$] +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques + - Linux Post-Exploitation + - Linux Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1547 + - T1037 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_usermod_root_uid_set.yml b/detections/endpoint/linux_usermod_root_uid_set.yml new file mode 100644 index 0000000000..443c1fe2e1 --- /dev/null +++ b/detections/endpoint/linux_usermod_root_uid_set.yml @@ -0,0 +1,79 @@ +name: Linux Usermod Root UID Set +id: fe143ad6-ef29-4571-be14-0cd08a32ff34 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects the use of usermod to set a user's UID to 0. This functionally sets the user as a root user with full permissions. This approach can be used to bypass regular privilege escalation mechanisms, giving the attacker full control over the system while appearing as a regular user in most monitoring tools. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes + WHERE Processes.process_name="usermod" + AND (Processes.process IN ("* -u 0 *", "* -u 0") OR Processes.process="*--uid 0*") + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_usermod_root_uid_set_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Setting a user's UID to 0 is extremely rare in legitimate administration — there is almost no valid operational reason to create a second root-equivalent account this way. False positives are expected to be very low. Verify any alert against change management records before dismissing. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux Usermod Root UID Set identified on $dest$ by $user$ via $process_name$ + entity: + field: user + type: user + score: 50 +intermediate_findings: + entities: + - field: dest + type: system + score: 50 + message: Potential Usermod Root UID Set by $user$ on $dest$ via $process_name$. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1098 + - T1078 + - T1548.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux From e7d170f8c1da9b639cf8334364b93affcadd6a69 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Fri, 7 Aug 2026 10:18:24 -0400 Subject: [PATCH 063/164] Another snapattack Windows Batch (#4192) --------- Co-authored-by: Nasreddine Bencherchali --- .../windows_dir_piped_to_findstr_activity.yml | 63 ++++++++++++ ...windows_network_sniffing_tool_executed.yml | 97 +++++++++++++++++++ ...ndows_powershell_commands_from_dns_txt.yml | 81 ++++++++++++++++ ...uspicious_child_process_of_consent_exe.yml | 88 +++++++++++++++++ lookups/csv/attacker_tools.csv | 1 + lookups/csv/attacker_tools.yml | 4 +- 6 files changed, 332 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/windows_dir_piped_to_findstr_activity.yml create mode 100644 detections/endpoint/windows_network_sniffing_tool_executed.yml create mode 100644 detections/endpoint/windows_powershell_commands_from_dns_txt.yml create mode 100644 detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml diff --git a/detections/endpoint/windows_dir_piped_to_findstr_activity.yml b/detections/endpoint/windows_dir_piped_to_findstr_activity.yml new file mode 100644 index 0000000000..2fc39639ef --- /dev/null +++ b/detections/endpoint/windows_dir_piped_to_findstr_activity.yml @@ -0,0 +1,63 @@ +name: Windows Dir Piped to Findstr Activity +id: 43cd7a59-3d52-4969-a01a-d677630b1426 +version: 1 +creation_date: '2026-07-30' +modification_date: '2026-07-30' +author: Raven Tait, Splunk +status: production +type: Hunting +description: |- + The following analytic detects the execution of the `dir` command piped to `findstr` on Windows systems. + This technique is commonly used by attackers during the reconnaissance phase to enumerate files, directories, or sensitive data by filtering directory listings for specific strings or patterns. + While this command combination can have legitimate administrative uses, adversaries frequently leverage it to locate credentials, configuration files, or other high-value targets on a compromised system. + If confirmed malicious, this activity could indicate an attacker is actively mapping the file system in preparation for data exfiltration, lateral movement, or further exploitation. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process="*dir *|*findstr *" + + by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash + Processes.parent_process_name Processes.parent_process_exec Processes.action + Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name + Processes.parent_process Processes.parent_process_path Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid + Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_dir_piped_to_findstr_activity_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate administrative tasks and scripts may use `dir` piped to `findstr` for routine file searches. + Filter based on known user behavior and approved administrative activity. +analytic_story: + - Suspicious Command-Line Executions + - Windows Discovery Techniques + - Active Directory Discovery +asset_type: Endpoint +mitre_attack_id: + - T1119 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_network_sniffing_tool_executed.yml b/detections/endpoint/windows_network_sniffing_tool_executed.yml new file mode 100644 index 0000000000..66ede70c61 --- /dev/null +++ b/detections/endpoint/windows_network_sniffing_tool_executed.yml @@ -0,0 +1,97 @@ +name: Windows Network Sniffing Tool Executed +id: 0c594353-e12d-4867-92f6-2a1b8a1faf5f +version: 1 +creation_date: '2026-07-30' +modification_date: '2026-07-30' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the execution of common network sniffing tools on Windows systems, including Wireshark, WinPcap, tcpdump, and similar utilities. + This activity is significant because attackers use packet capture tools to intercept and analyze network traffic, enabling credential theft, sensitive data harvesting, and reconnaissance of internal network communications. + While these tools have legitimate administrative uses, their presence in unexpected environments may indicate an adversary conducting man-in-the-middle attacks or exfiltrating sensitive information traversing the network. + If confirmed malicious, this could lead to the exposure of credentials, session tokens, and confidential data, facilitating lateral movement and further compromise of the environment. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name IN ( + "dumpcap.exe", + "netcap.exe", + "netmon.exe", + "tcpdump.exe", + "tshark.exe", + "windump.exe", + "winpcap.exe", + "wireshark.exe" + ) + + by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash + Processes.parent_process_name Processes.parent_process_exec Processes.action + Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid Processes.process_id + Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_network_sniffing_tool_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate network administrators and security teams may use these tools for authorized network monitoring and troubleshooting. Filter based on approved software inventory and known administrative activity. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Network Sniffing utility execution identified on [$dest$] via [$process_name$] and the Command Line [$process$] executed by [$user$]. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Credential Dumping + - Data Exfiltration + - Suspicious Command-Line Executions + - Windows Discovery Techniques + - Network Discovery +asset_type: Endpoint +mitre_attack_id: + - T1040 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_commands_from_dns_txt.yml b/detections/endpoint/windows_powershell_commands_from_dns_txt.yml new file mode 100644 index 0000000000..04d20490fe --- /dev/null +++ b/detections/endpoint/windows_powershell_commands_from_dns_txt.yml @@ -0,0 +1,81 @@ +name: Windows Powershell Commands from DNS TXT +id: b61353cd-5b09-4699-8b86-6517a9038043 +version: 1 +creation_date: '2026-07-30' +modification_date: '2026-07-30' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects execution of powershell commands retrieved from a remote DNS TXT query response. + The use of the DNS TXT record for C2 is an uncommon method for malware that is resilient due to the need for DNS in normal networking + activities. + This can ensure that their C2 is not blocked by any firewalls. +data_source: + - Powershell Script Block Logging 4104 +search: |- + `powershell` + EventCode=4104 + ScriptBlockText IN ("*resolve-dnsname *", "*nslookup *", "*dig *") + ScriptBlockText IN ("*-Type TXT*", "*type=txt*", "* TXT*") + ScriptBlockText IN ("*. (*", "*IEX*") + + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_commands_from_dns_txt_filter` +how_to_implement: |- + To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions are available at https://docs.splunk.com/Documentation/ES/latest/Admin/Configurepowershelllogging. +known_false_positives: |- + While false positives should be unlikely given the uncommon combination of PowerShell execution and DNS TXT query responses. + Due to the nature of Script Block Logging, it is possible that legitimate strings or unrelated commands might all match at once. + Apply appropriate exclusions for those edge cases. +drilldown_searches: + - name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A suspicious PowerShell script with the ScriptBlockId [$ScriptBlockId$] containing DNS TXT query commands was executed on host $dest$ + - field: user_id + type: user + score: 20 + message: A suspicious PowerShell script with the ScriptBlockId [$ScriptBlockId$] containing DNS TXT query commands was executed on host $dest$ by user $user_id$ +analytic_story: + - Malicious PowerShell + - Command And Control + - Suspicious DNS Traffic +asset_type: Endpoint +mitre_attack_id: + - T1071.004 + - T1059.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +security_domain: endpoint +category: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml b/detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml new file mode 100644 index 0000000000..dcf82d7b70 --- /dev/null +++ b/detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml @@ -0,0 +1,88 @@ +name: Windows Suspicious Child Process of Consent.EXE +id: 8194b5d4-41ae-4ce7-adfb-92d375e341d2 +version: 1 +creation_date: '2026-07-30' +modification_date: '2026-07-30' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects unexpected child processes spawned by consent.exe, the Windows UAC consent dialog binary. + Consent.exe is responsible solely for rendering the UAC elevation prompt and should not spawn child processes under normal operating conditions; child process creation from this parent is a known indicator of UAC bypass and privilege escalation techniques. + The detection identifies any executable launched as a child of consent.exe, excluding the expected WerFault.exe error reporting process, which may legitimately appear in crash scenarios. + This behavior is associated with UAC bypass exploits and has been observed in multiple post-exploitation frameworks as a means of obtaining elevated privileges without triggering a visible UAC prompt. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_name="consent.exe" + Processes.process_name="*.exe" + NOT Processes.process_name="WerFault.exe" + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process + Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_child_process_of_consent_exe_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate software installations or system updates may occasionally trigger child processes under consent.exe but these should be rare. + Verify any flagged activity against known administrative actions or recent software changes. +references: + - https://securelist.com/cve-2024-30051/112618/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Child of [$parent_process_path$] activity observed on [$dest$] via [$process$] executed by [$user$] +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Windows Privilege Escalation + - Unusual Processes +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1548.002 + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack_windows.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/lookups/csv/attacker_tools.csv b/lookups/csv/attacker_tools.csv index ae526f76b0..10d83a6a54 100644 --- a/lookups/csv/attacker_tools.csv +++ b/lookups/csv/attacker_tools.csv @@ -24,6 +24,7 @@ netpass.exe,This process was identified as malicious by DHS Alert TA18-201A and NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits NLBrute.exe,A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords. nmap.exe,This process is an open source network mapping tool used to identify hosts and listening services on a network. +netscan.exe,NetScan is a network scanning tool used to discover hosts and services on a network. It is commonly leveraged by threat actors during the discovery phase to enumerate active hosts and open ports within a target environment. ns.exe,A commonly used tool used by attackers to scan and map file shares ntdll.exe,This process was identified as malicious by DHS Alert TA18-074A. OutlookAddressBookView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook. diff --git a/lookups/csv/attacker_tools.yml b/lookups/csv/attacker_tools.yml index 155a36591f..737617f2b9 100644 --- a/lookups/csv/attacker_tools.yml +++ b/lookups/csv/attacker_tools.yml @@ -1,8 +1,8 @@ name: attacker_tools id: 72620fe1-26cb-4cee-a6ee-8c6127056d81 -version: 6 +version: 7 creation_date: '2021-07-12' -modification_date: '2026-05-13' +modification_date: '2026-08-07' author: Splunk Threat Research Team lookup_type: csv description: A list of tools used by attackers From 48b0ba4856216930072d937ceba51162314bf1a1 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 7 Aug 2026 18:48:26 +0200 Subject: [PATCH 064/164] Overlord Fixes (#4206) --- .../endpoint/linux_possible_bootloader_modification.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_possible_bootloader_modification.yml b/detections/endpoint/linux_possible_bootloader_modification.yml index d1ecc96baf..604d947263 100644 --- a/detections/endpoint/linux_possible_bootloader_modification.yml +++ b/detections/endpoint/linux_possible_bootloader_modification.yml @@ -23,7 +23,7 @@ search: |- Processes.process_name IN ( "cp", "mv", - "ln", + "ln" ) Processes.process_current_directory="*/EFI/BOOT*" ) @@ -33,7 +33,7 @@ search: |- NOT Processes.process_name IN ( "ls", "grep", - "egrep", + "egrep" ) ) From a9ff0e20cb4fe1319ac581ff2fa64a536d8a8842 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 7 Aug 2026 20:29:29 +0200 Subject: [PATCH 065/164] More Overlord Fixes (#4207) --- data_sources/sysmon_for_linux_eventid_3.yml | 108 ++++++++++++++++++ .../linux_netcat_outbound_connection.yml | 2 +- ...le_privilege_escalation_via_pythonpath.yml | 9 +- 3 files changed, 117 insertions(+), 2 deletions(-) create mode 100644 data_sources/sysmon_for_linux_eventid_3.yml diff --git a/data_sources/sysmon_for_linux_eventid_3.yml b/data_sources/sysmon_for_linux_eventid_3.yml new file mode 100644 index 0000000000..ffaa13a39f --- /dev/null +++ b/data_sources/sysmon_for_linux_eventid_3.yml @@ -0,0 +1,108 @@ +name: Sysmon for Linux EventID 3 +id: c56ce9d3-a37e-43a5-a0e6-b3b7d03600a4 +version: 1 +creation_date: '2026-08-07' +modification_date: '2026-08-07' +author: Nasreddine Bencherchali, Splunk +description: Logs network connection creation events on Linux systems, including details about the source and destination IPs, ports, protocols, and the associated process metadata. +mitre_components: + - Network Connection Creation + - Network Traffic Flow + - Process Metadata + - Application Log Content + - OS API Execution +source: Syslog:Linux-Sysmon/Operational +sourcetype: sysmon:linux +separator: EventID +separator_value: '3' +supported_TA: + - name: Splunk Add-on for Sysmon for Linux + url: https://splunkbase.splunk.com/app/6652 + version: 1.0.0 +fields: + - _time + - action + - app + - Computer + - creation_time + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_ip + - dest_port + - DestinationHostname + - DestinationIp + - DestinationIsIpv6 + - DestinationPort + - DestinationPortName + - direction + - dvc + - dvc_ip + - EventDescription + - EventID + - eventtype + - Guid + - host + - Image + - index + - Initiated + - Interesting Fields + - Keywords + - linecount + - Name + - process_exec + - process_guid + - process_id + - process_name + - ProcessGuid + - ProcessId + - ProcessID + - protocol + - Protocol + - protocol_version + - punct + - RuleName + - signature + - signature_id + - source + - SourceHostname + - SourceIp + - SourceIsIpv6 + - SourcePort + - SourcePortName + - sourcetype + - splunk_server + - src + - src_ip + - src_port + - state + - SystemTime + - tag + - tag::eventtype + - ThreadID + - timeendpos + - timestartpos + - transport + - transport_dest_port + - user + - user_id + - UserId + - UtcTime + - vendor_product + - xmlns +output_fields: + - src + - dest + - dest_port + - transport + - process_name + - app + - user + - process_id +example_log: 354300x80000000000000001068124Linux-Sysmon/Operationalip-10-0-76-137-2022-08-31 18:16:47.184{ec21f57b-a58f-630f-05a2-4983a0550000}7658/usr/bin/ncatroottcptruefalse10.0.76.137-53976-false10.0.76.44-4444- diff --git a/detections/endpoint/linux_netcat_outbound_connection.yml b/detections/endpoint/linux_netcat_outbound_connection.yml index 30ddef8070..272fd23a1e 100644 --- a/detections/endpoint/linux_netcat_outbound_connection.yml +++ b/detections/endpoint/linux_netcat_outbound_connection.yml @@ -12,7 +12,7 @@ description: |- This activity is significant because outbound connections from these binaries often indicate an active compromise, where an attacker may be maintaining command-and-control communication or tunneling malicious traffic. If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system. data_source: - - Sysmon EventID 3 + - Sysmon for Linux EventID 3 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml index 44dfa16e20..2a29b41720 100644 --- a/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml +++ b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml @@ -20,7 +20,14 @@ search: |- from datamodel=Endpoint.Filesystem where Filesystem.file_path="*/importlib/__init__.so*" - NOT Filesystem.file_path="*/lib/*" + NOT Filesystem.file_path IN ( + "/lib/*", + "/lib64/*", + "/usr/lib/*", + "/usr/lib64/*", + "/usr/local/lib/*", + "/usr/local/lib64/*" + ) by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest Filesystem.process_guid Filesystem.process_id From f4775123ee3bf0910abd44d099f48014f7b3953c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 13 Aug 2026 07:55:55 -0700 Subject: [PATCH 066/164] Update data source TA and install.yml app versions (#4213) --- data_sources/cisco_ai_defense_alerts.yml | 2 +- data_sources/cisco_asa_logs.yml | 2 +- data_sources/cisco_duo_activity.yml | 2 +- data_sources/cisco_duo_administrator.yml | 2 +- data_sources/cisco_isovalent_process_connect.yml | 2 +- data_sources/cisco_isovalent_process_exec.yml | 2 +- data_sources/cisco_isovalent_process_kprobe.yml | 2 +- data_sources/cisco_network_visibility_module_flow_data.yml | 2 +- data_sources/cisco_network_visibility_module_osquery.yml | 2 +- .../cisco_secure_firewall_threat_defense_connection_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_file_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_intrusion_event.yml | 2 +- data_sources/github_enterprise_audit_logs.yml | 2 +- data_sources/github_organizations_audit_logs.yml | 2 +- data_sources/linux_auditd_add_user.yml | 2 +- data_sources/linux_auditd_cwd.yml | 2 +- data_sources/linux_auditd_daemon_abort.yml | 2 +- data_sources/linux_auditd_daemon_end.yml | 2 +- data_sources/linux_auditd_daemon_start.yml | 2 +- data_sources/linux_auditd_execve.yml | 2 +- data_sources/linux_auditd_path.yml | 2 +- data_sources/linux_auditd_proctitle.yml | 2 +- data_sources/linux_auditd_service_stop.yml | 2 +- data_sources/linux_auditd_syscall.yml | 2 +- data_sources/linux_messages_syslog.yml | 2 +- data_sources/linux_secure.yml | 2 +- data_sources/nginx_access.yml | 2 +- 27 files changed, 27 insertions(+), 27 deletions(-) diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index 1404dec13c..1c672354b4 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -11,5 +11,5 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index 1a8e032607..61d0ec4d56 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - Cisco_ASA_action - Cisco_ASA_message_id diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index ef4d9c214e..57f78a420b 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - access_device.browser - access_device.browser_version diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index c9e8471027..ba87861cc1 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - action - actionlabel diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index 4176c4e24e..2ed3fe0059 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - _time - app diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index fbc9e8fda2..53b8c8dcd6 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - _time - cluster_name diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 9b5f9b9fc8..82e8b8c3d4 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - _time - app diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index 35fb13dd7a..402fddfdd5 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:flowdata:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - action - aliul diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 710ef263b0..569f2e8972 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:osquery:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - current_page - date_hour diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index 2e6a88ad82..3a199b6f48 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - AC_RuleAction - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index 022971efeb..84d09c5837 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - app - Application diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index 1552ce4c57..db18b5a342 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - Application - Classification diff --git a/data_sources/github_enterprise_audit_logs.yml b/data_sources/github_enterprise_audit_logs.yml index f980d37742..266202314d 100644 --- a/data_sources/github_enterprise_audit_logs.yml +++ b/data_sources/github_enterprise_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: httpevent supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 3.3.1 + version: 4.0.0 fields: - _document_id - action diff --git a/data_sources/github_organizations_audit_logs.yml b/data_sources/github_organizations_audit_logs.yml index cf90f2b8cf..1a187a6d09 100644 --- a/data_sources/github_organizations_audit_logs.yml +++ b/data_sources/github_organizations_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: github:cloud:audit supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 3.3.1 + version: 4.0.0 fields: - _document_id - action diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 52378a5ee6..835c71b6a8 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index d39ee1fddc..4922427446 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index e46aa9c326..e311d74600 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index 0522a1d413..46c537bc68 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 4024d17bc8..5c6aa25a0f 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index e72fcaef2f..231d750fc2 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 1ec1119e7d..b368989f15 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 4b3af11875..1950f4a8eb 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 71d083b8e5..cdc8d643e7 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index 7582dd5dc0..5e99e36493 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 7e89cd959e..574409798e 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -15,7 +15,7 @@ sourcetype: linux_messages_syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - _time - action diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index f01804afa2..648850c8d0 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - _time - action diff --git a/data_sources/nginx_access.yml b/data_sources/nginx_access.yml index 8c249409e4..3b205f3932 100644 --- a/data_sources/nginx_access.yml +++ b/data_sources/nginx_access.yml @@ -16,7 +16,7 @@ sourcetype: nginx:plus:kv supported_TA: - name: Splunk Add-on for NGINX url: https://splunkbase.splunk.com/app/3258 - version: 3.3.0 + version: 3.3.1 fields: - _time - action From 9a930964bbf10c4e1536c3e4b29afd6a62708108 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 13 Aug 2026 17:38:04 +0200 Subject: [PATCH 067/164] Bump contentctl.yml and build.yml to 6.5.0 (#4214) * Update build.yml * Update contentctl.yml --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index ddabf18dcc..aee844016c 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.4.0 +app_version: 6.5.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index d066a0ef9e..b1f828f54e 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.4.0 + version: 6.5.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From ef7b62198c55aad9405835cd686181cdd33d652b Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 13 Aug 2026 12:50:49 -0700 Subject: [PATCH 068/164] convert the exclsuion of TA (#4215) from the normal updater process from a hardcoded exclusion for the windows TA to a comment in case this needs to be done in the future. --- .github/workflows/datasource-dependabot.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 6553786624..752b6063e6 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -32,10 +32,13 @@ jobs: echo "Updating data source supported_TA and repo install.yml app versions" contentctl-ng update-data-source-tas --content-dirs . - # TODO: Remove this when we are fully compatible with the latest version of the Windows TA - # Temporarily roll back any automated updates to the Windows TA because we intentionally - # want to pin to the current version. - git checkout -- $(grep -rl "https://splunkbase.splunk.com/app/742" data_sources/) + # TODO: This comment is intentionally left in this workflow to demonstrate how individuals + # TAs can be intentionally excluded from updates, for example when we have intentionally pinned + # to an older version of a TA. In the future, we will try to make this a formally documented + # feature of contentctl-ng, but needing to do this is fairly rare and with out other priorities, + # does not fit at this time. + # The demonstration below shows how to exlcude the windows TA from updates, if necessary. + # git checkout -- $(grep -rl "https://splunkbase.splunk.com/app/742" data_sources/) echo "Changed data source and install.yml files:" git status --short -- data_sources install.yml From 457ce9f5ea69a8d5be9463989ee23b9366858d16 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 13 Aug 2026 12:55:22 -0700 Subject: [PATCH 069/164] Update data source TA and install.yml app versions (#4216) Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 98 files changed, 98 insertions(+), 98 deletions(-) diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 141ebdf0de..c075b634ac 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index da24c4688c..d8b431c098 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index e4ec349eb5..735b7e553d 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6a20ab8128..3c98545a95 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 7e1ec4fde7..e5f967841b 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 4ef6ecee00..c27efb791d 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index fb960b1d42..4371cdb243 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 9107707eaf..61ea534643 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index a98f34690b..7caa8736d8 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index b45b9b50fa..08734940de 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 869197ab81..39792c136b 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 792a15ebbc..9f50ea89e6 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 22e3b71725..6b38cc2db5 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 00920b4b37..4ff056df30 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 2701795166..aef7469c11 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index f4e7771023..aa03a03585 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 14d92e22a7..5f5c5af5cb 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 011347afb2..167cda8c70 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 9c97a01efe..33600c1231 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 77928d8273..149b631190 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index b0b5c2cef0..0b5a3d83a2 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 8d9767ba9c..70617fdd7e 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 7b59c9cd6b..599f4a67e0 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 1a813f46f9..0317ab0fb4 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 88cb4531d3..48f1409144 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 3b54c95906..d9c827fef6 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 882e7a7bd0..690ee87c8c 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 257bd4a5d4..f79b3dfdd2 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 529620eb60..3da36ee8f0 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index d952de1f7e..aba8ee364c 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 6bd7d957fc..e86b09685a 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 3dbf23664f..f113a86355 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 8586c6984d..7a56fa568b 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 3971f62bfc..cb5f1d0853 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 28e5d9fead..9da8575acc 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index e8c1fb0efb..7f378ce075 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 6b8fa7d829..fa943bf787 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index c0dc0121e4..5584723fb0 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index f74d26c94a..47b3a08dfd 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 280d7f8262..898f064d0e 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 642687b596..dd02fdcfcf 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 3b4b6a9c06..24bf4ad87b 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index a80ed23a9b..971447d98b 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 4dc60cd9bd..27ce4cad6d 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - EventID example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 7184ff77e3..a5ac7fbcd5 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - EventID example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 5c1d729155..8d66db7b5a 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 06b3adb988..71a66f1666 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 31484a3587..485dc71519 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 26eb1728db..dd4a4102e2 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 0b06b7823a..d32bd3cb4c 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index ca05c7b840..7d45acc942 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 6ddc2aba57..68503802fc 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 0aa2c2f0b7..7ca3ba9a14 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index bcba79a79d..4e4f8d4247 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 9487a6ac52..5e2a3ba701 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 30f8bc23e8..8d78f08e21 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index d95f852eb8..16f6cdfa8b 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index f128bbfcc4..7525a3f1ce 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index fb6f1f3ca8..70ee3355a5 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index b0f6314703..99a689249a 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 7b643fb3d0..625bd64d26 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index eb26156fe9..7e0125e963 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 216eb54d2c..7dff88ff14 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 8b61381ede..0a86c60d10 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 4dbe460a36..d38bdbdaa9 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index c53348491f..638cd75b6f 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 9db0814db3..45f712c76c 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 0d954d3b5c..4ceba33a50 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 2b1506eda9..8d9f1de577 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 16751ea4ef..e31dcec12a 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 408aaa466b..513d1d6b3d 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index ed8f3691a8..7c10ebc547 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index 4b239b5056..95936495e4 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 8a945e0fe8..5cb3443f3d 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 70bae43f05..e335d8bd7f 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 8eebe0e5a9..cf3a023f06 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index bdd7735a81..4fd370c8f1 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 9379641c7d..afe8d53f69 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 2016e280f6..5216d86c0d 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 2d9e806305..32ceb5f974 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index b10ef8870b..fa8949c735 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 961be864ee..f5eca48d81 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index b2035008e4..c22ef0fcdb 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 253ce10397..91bbceceec 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index f5f3cf1116..1824749f9b 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 393098f288..333bbbbd67 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 1647d2e832..0a15bd0258 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index faea29ccad..28f5ab09be 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 49df88f658..1a6be457d1 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 642359a985..00e26d4add 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index dd3e3849ea..746332e5b8 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 0cf395b1d2..65f12a428a 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 518d67eacf..b907e1451a 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index a1fda46fe8..9648dd5f24 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index e7fe0ff722..98678fd0fe 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 01ff84004b..458cf6a3a7 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index a3412a3b42..7995528f40 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 8c6977fd3a..c0d809bc9e 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ComputerName From 193c836185bf6d4f1cbb19ac6283f74ca5a8681a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Sat, 15 Aug 2026 15:30:12 -0700 Subject: [PATCH 070/164] Update data source TA and install.yml app versions (#4218) Co-authored-by: tjgeorgen <67936042+tjgeorgen@users.noreply.github.com> --- data_sources/palo_alto_network_threat.yml | 2 +- data_sources/palo_alto_network_traffic.yml | 2 +- install.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index 9567c997b9..b133bf04e7 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.2.2 + version: 4.0.0 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index ac49f6e6a4..07d645dc59 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.2.2 + version: 4.0.0 fields: - _time - date_hour diff --git a/install.yml b/install.yml index 60db3de09f..1abe7d5b2b 100644 --- a/install.yml +++ b/install.yml @@ -24,7 +24,7 @@ apps: version: 1.3.2 - appid: Splunk_TA_google-cloudplatform url: https://splunkbase.splunk.com/app/3088 - version: 5.1.0 + version: 5.1.1 - appid: utbox url: https://splunkbase.splunk.com/app/2734 version: 1.9.4 From f91a89b9ad8f2fe468b1a25e219949b47f3b0631 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 17 Aug 2026 09:44:12 -0700 Subject: [PATCH 071/164] The following attack data links were partially bad, but not totally wrong. (#4209) Several of them had a path containing double backslash, like attack_data//T1003/file.log. This is resolvable by a redirect, but still wrong. A few others did not point to the prefix https://media.githubusercontent.com/media/splunk/attack_data/master/datasets and instead started with https://media.githubusercontent.com/media/splunk/attack_data/refs/head/master/datasets which, while it still resolved, was wrong Co-authored-by: Nasreddine Bencherchali --- .../linux_auditd_unix_shell_configuration_modification.yml | 2 +- detections/endpoint/macos_list_firewall_rules.yml | 2 +- detections/endpoint/msmpeng_application_dll_side_loading.yml | 2 +- .../endpoint/windows_modify_registry_configure_bitlocker.yml | 2 +- detections/endpoint/windows_modify_registry_disable_rdp.yml | 2 +- detections/endpoint/windows_unsigned_ms_dll_side_loading.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 93c8db6aa9..0a7ed99af8 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -97,7 +97,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config//linux_path_profile_d.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_path_profile_d.log source: auditd sourcetype: auditd test_type: unit diff --git a/detections/endpoint/macos_list_firewall_rules.yml b/detections/endpoint/macos_list_firewall_rules.yml index 385579a91c..488af3e230 100644 --- a/detections/endpoint/macos_list_firewall_rules.yml +++ b/detections/endpoint/macos_list_firewall_rules.yml @@ -92,7 +92,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_list_firewall_rules.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_list_firewall_rules.log sourcetype: osquery:results source: osquery test_type: unit diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 0bc2c3168f..6957aa4da6 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -44,7 +44,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/msmpeng_side/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_modify_registry_configure_bitlocker.yml b/detections/endpoint/windows_modify_registry_configure_bitlocker.yml index 3238b2d82c..ccff5acbcb 100644 --- a/detections/endpoint/windows_modify_registry_configure_bitlocker.yml +++ b/detections/endpoint/windows_modify_registry_configure_bitlocker.yml @@ -43,7 +43,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/bitlocker_registry_setting//fve-reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/bitlocker_registry_setting/fve-reg.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_modify_registry_disable_rdp.yml b/detections/endpoint/windows_modify_registry_disable_rdp.yml index 312c8ab192..b56ea1e175 100644 --- a/detections/endpoint/windows_modify_registry_disable_rdp.yml +++ b/detections/endpoint/windows_modify_registry_disable_rdp.yml @@ -44,7 +44,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_rdp//fdenytsconnection-reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_rdp/fdenytsconnection-reg.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 55dca55346..71387cbe8f 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -86,7 +86,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load//wineloader_dll_sideload.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load/wineloader_dll_sideload.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational test_type: unit From b9357ea1b0bd971bdfa8f6011eae1d936d352d64 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 18 Aug 2026 03:48:31 -0700 Subject: [PATCH 072/164] Update data source TA and install.yml app versions (#4225) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 98 files changed, 98 insertions(+), 98 deletions(-) diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index c075b634ac..749a2d3ae1 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index d8b431c098..045f5a43f3 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index 735b7e553d..d7df32bf79 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 3c98545a95..6089a236b5 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index e5f967841b..b43f02de4b 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index c27efb791d..953e724a1e 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index 4371cdb243..dfbc3ae1ed 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 61ea534643..df3d27c6c7 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 7caa8736d8..7f333a78f9 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index 08734940de..e3841b7d77 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 39792c136b..6c924b1ebb 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 9f50ea89e6..f72140ae8d 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 6b38cc2db5..870de7ee17 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 4ff056df30..cf70c22f8c 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index aef7469c11..592e0b6ef3 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index aa03a03585..66ada13148 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 5f5c5af5cb..4c7a4f8b93 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 167cda8c70..e79d991237 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 33600c1231..ad28a09086 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 149b631190..db460b697e 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 0b5a3d83a2..2bbe2b2b19 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 70617fdd7e..ad851b6a94 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 599f4a67e0..c014f6885a 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 0317ab0fb4..88a8748b5b 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 48f1409144..70dc254190 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index d9c827fef6..f5889d38fd 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 690ee87c8c..10c8ddbede 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index f79b3dfdd2..2aa8588d75 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 3da36ee8f0..28d99290fb 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index aba8ee364c..38622b24f5 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index e86b09685a..060336e042 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index f113a86355..75f9683746 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 7a56fa568b..f59cb881fd 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index cb5f1d0853..c48507cfc3 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 9da8575acc..dad4989547 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index 7f378ce075..89fba03f2c 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index fa943bf787..b4667be60c 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index 5584723fb0..fa95daaa50 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 47b3a08dfd..104eb80b58 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 898f064d0e..289d62a902 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index dd02fdcfcf..989857e278 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 24bf4ad87b..a440f483f9 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 971447d98b..54054afabb 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 27ce4cad6d..3d13a756ee 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - EventID example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index a5ac7fbcd5..4c180ca38a 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - EventID example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 8d66db7b5a..ed09ed27bd 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 71a66f1666..4a8dfb8ca5 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 485dc71519..5e2bbda6ab 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index dd4a4102e2..fd486f8f61 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index d32bd3cb4c..a9cd94593d 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 7d45acc942..9524a3f72f 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 68503802fc..8136745ad8 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 7ca3ba9a14..24032e276b 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index 4e4f8d4247..ab74f07c8d 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 5e2a3ba701..d73d16002d 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 8d78f08e21..fefeeec125 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 16f6cdfa8b..3fdffb89a8 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 7525a3f1ce..881d7ccf05 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 70ee3355a5..9c4df3de2d 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index 99a689249a..7784f95bb3 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 625bd64d26..1c4c800fe0 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 7e0125e963..027458aca6 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 7dff88ff14..f02e15fa1a 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 0a86c60d10..dac0a891f9 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index d38bdbdaa9..27c818f289 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index 638cd75b6f..f73f48479e 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 45f712c76c..8978d1ea3f 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 4ceba33a50..44102ebf15 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 8d9f1de577..f29190cc07 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index e31dcec12a..bff553454a 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 513d1d6b3d..b01e5a06bb 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index 7c10ebc547..f8856f02cd 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index 95936495e4..c21f93675c 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 5cb3443f3d..da4093a413 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index e335d8bd7f..75ffcb4b33 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index cf3a023f06..50d72b8dc7 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 4fd370c8f1..8c021ffff6 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index afe8d53f69..fc950fe649 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 5216d86c0d..88e0dff853 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 32ceb5f974..361668dc89 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index fa8949c735..892346a598 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index f5eca48d81..3ed3918118 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index c22ef0fcdb..fe9b0aa1ac 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 91bbceceec..4ff1c91b19 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 1824749f9b..31c604a503 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 333bbbbd67..03d0bbe1f6 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 0a15bd0258..bd20531413 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index 28f5ab09be..b7298c6713 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 1a6be457d1..5b95d4b808 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 00e26d4add..b5590d7546 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 746332e5b8..2ca373f47e 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 65f12a428a..6cd9b92a19 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index b907e1451a..d43588fae6 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 9648dd5f24..1aa7fef426 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index 98678fd0fe..31739b254e 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 458cf6a3a7..6809dbf363 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 7995528f40..521b00579b 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index c0d809bc9e..27abf33af6 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ComputerName From b4886ff0ca06af3f2c4f00ef73780f3b8fc82b85 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 18 Aug 2026 19:31:00 +0200 Subject: [PATCH 073/164] add field ordering workflows and scripts (#4208) --- .github/workflows/yaml-validation.yml | 14 + .pre-commit-config.yaml | 8 + .yamlfieldorder | 46 +++ ..._cross_region_possible_inference_abuse.yml | 4 +- ...edrock_claude_hostile_prompt_sentiment.yml | 8 +- ...drock_claude_possible_prompt_injection.yml | 10 +- ...drock_claude_sensitive_data_in_prompts.yml | 8 +- ...bedrock_claude_unusually_large_prompts.yml | 10 +- ...binary_launched_process_with_null_argv.yml | 6 +- .../endpoint/linux_malformed_auth_entry.yml | 4 +- ...lg_registration_outside_of_boot_window.yml | 4 +- .../linux_suspicious_namespace_creation.yml | 6 +- ...ws_admin_password_changed_by_non_admin.yml | 4 +- ...lter_log_created_by_non_system_process.yml | 4 +- .../windows_msmpeng_writing_to_system32.yml | 4 +- ...tem_process_querying_definition_update.yml | 4 +- ...ndows_powershell_commands_from_dns_txt.yml | 2 +- ...s_suspicious_burst_of_password_changes.yml | 4 +- ...ld_process_of_tieringengineservice_exe.yml | 4 +- ...nder_engine_or_signature_files_created.yml | 4 +- ..._defender_update_activity_in_inetcache.yml | 4 +- ...ssvc_process_accessing_defender_engine.yml | 4 +- docs/ci/yaml_formatting.md | 12 +- scripts/enforce_yaml_field_order.py | 382 ++++++++++++++++++ scripts/validate_yaml.py | 50 ++- 25 files changed, 556 insertions(+), 54 deletions(-) create mode 100644 .yamlfieldorder create mode 100644 scripts/enforce_yaml_field_order.py diff --git a/.github/workflows/yaml-validation.yml b/.github/workflows/yaml-validation.yml index fe4aa381c5..fa5640e36c 100644 --- a/.github/workflows/yaml-validation.yml +++ b/.github/workflows/yaml-validation.yml @@ -5,12 +5,26 @@ on: paths: - 'detections/**/*.yml' - 'detections/**/*.yaml' + - '.yamlfieldorder' + - '.yamlfmt' + - '.yamllint' + - '.pre-commit-config.yaml' + - 'scripts/enforce_yaml_field_order.py' + - 'scripts/validate_yaml.py' + - '.github/workflows/yaml-validation.yml' push: branches: - develop paths: - 'detections/**/*.yml' - 'detections/**/*.yaml' + - '.yamlfieldorder' + - '.yamlfmt' + - '.yamllint' + - '.pre-commit-config.yaml' + - 'scripts/enforce_yaml_field_order.py' + - 'scripts/validate_yaml.py' + - '.github/workflows/yaml-validation.yml' jobs: validate: diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 3b5877a65c..c71a44920b 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -22,3 +22,11 @@ repos: pass_filenames: true # Optional: Specify custom yamlfmt binary path if not in PATH # args: [--yamlfmt-path, /path/to/yamlfmt] + + - id: yaml-field-order + name: YAML field order (detections only) + description: Enforce configured root field order in detection YAML files + entry: python scripts/enforce_yaml_field_order.py --fix + language: python + files: ^detections/.*\.(yml|yaml)$ + pass_filenames: true diff --git a/.yamlfieldorder b/.yamlfieldorder new file mode 100644 index 0000000000..36f5054b52 --- /dev/null +++ b/.yamlfieldorder @@ -0,0 +1,46 @@ +# Root field order for detection YAML files. +# +# The formatter moves whole top-level YAML blocks and does not re-emit YAML. +# This preserves indentation, spaces, comments, scalar style, and nested content +# inside each field block. +target_paths: + - detections/ + +extensions: + - .yml + - .yaml + +# Unknown top-level fields are kept intact and appended after configured fields. +unknown_fields: append + +root_field_order: + - name + - id + - version + - creation_date + - modification_date + - author + - status + - type + - description + - data_source + - search + - how_to_implement + - known_false_positives + - references + - drilldown_searches + - finding + - intermediate_findings + - threat_objects + - analytic_story + - threat_group + - asset_type + - cve + - atomic_guid + - mitre_attack_id + - product + - category + - security_domain + - baselines + - tests + - deprecation_info diff --git a/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml b/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml index 3d7d8b682a..ceb9979090 100644 --- a/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml +++ b/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml @@ -6,10 +6,9 @@ modification_date: '2026-07-06' author: Rod Soto status: production type: Anomaly +description: This detection identifies potential cross-region inference abuse in AWS Bedrock Claude models. Cross-region inference abuse may indicate attempts to bypass regional restrictions, exfiltrate data, or perform unauthorized actions across different AWS regions. data_source: - AWS Bedrock Claude -category: application -description: This detection identifies potential cross-region inference abuse in AWS Bedrock Claude models. Cross-region inference abuse may indicate attempts to bypass regional restrictions, exfiltrate data, or perform unauthorized actions across different AWS regions. search: |- `aws_bedrock_claude` | rename "identity.arn" AS user_arn @@ -60,6 +59,7 @@ product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud +category: application security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml b/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml index fe1d52d919..1070ebd0da 100644 --- a/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml +++ b/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml @@ -3,14 +3,12 @@ id: 54734442-955a-4427-9a86-2d9712151067 version: 1 creation_date: '2026-07-06' modification_date: '2026-07-06' -security_domain: endpoint -data_source: - - AWS Bedrock Claude -category: application author: Rod Soto status: production type: Anomaly description: This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. Hostile prompts may indicate potential abuse, harassment, or other malicious intent. +data_source: + - AWS Bedrock Claude search: |- `aws_bedrock_claude` | rename "identity.arn" AS user_arn @@ -61,6 +59,8 @@ product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud +category: application +security_domain: endpoint tests: - name: True Positive Test test_type: unit diff --git a/detections/application/aws_bedrock_claude_possible_prompt_injection.yml b/detections/application/aws_bedrock_claude_possible_prompt_injection.yml index 4802504387..74e80256de 100644 --- a/detections/application/aws_bedrock_claude_possible_prompt_injection.yml +++ b/detections/application/aws_bedrock_claude_possible_prompt_injection.yml @@ -1,16 +1,14 @@ name: AWS Bedrock Claude Possible Prompt Injection id: 9e162548-3e9a-4a74-9eb5-34ee28350f07 version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' author: Rod Soto status: production type: Hunting -category: application -creation_date: '2026-07-06' -modification_date: '2026-07-06' -security_domain: endpoint +description: This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. These strings are not inherently malicious on their own - many of them (for example "act as", "you must", or "new persona") appear routinely in legitimate system prompts, few-shot examples, and role-play or creative-writing use cases. This is a hunting search rather than an anomaly detection because the base rate of benign matches is high; use it to pivot into the surrounding conversation and look for corroborating signals such as the phrase appearing mid-conversation rather than in an expected system/few-shot prompt, the user attempting to override guardrails or safety instructions rather than set a benign persona, instructions that follow the injected phrase requesting privilege escalation, data exfiltration, or access to restricted tools/resources, repeated or iterative attempts from the same user/role after being refused, and injected phrases originating from untrusted input (e.g., retrieved documents or tool output) rather than the human user turn. data_source: - AWS Bedrock Claude -description: This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. These strings are not inherently malicious on their own - many of them (for example "act as", "you must", or "new persona") appear routinely in legitimate system prompts, few-shot examples, and role-play or creative-writing use cases. This is a hunting search rather than an anomaly detection because the base rate of benign matches is high; use it to pivot into the surrounding conversation and look for corroborating signals such as the phrase appearing mid-conversation rather than in an expected system/few-shot prompt, the user attempting to override guardrails or safety instructions rather than set a benign persona, instructions that follow the injected phrase requesting privilege escalation, data exfiltration, or access to restricted tools/resources, repeated or iterative attempts from the same user/role after being refused, and injected phrases originating from untrusted input (e.g., retrieved documents or tool output) rather than the human user turn. search: |- `aws_bedrock_claude` | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv @@ -52,6 +50,8 @@ product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud +category: application +security_domain: endpoint tests: - name: True Positive Test test_type: unit diff --git a/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml b/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml index 49dcde6df8..2e14dadae5 100644 --- a/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml +++ b/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml @@ -1,14 +1,14 @@ name: AWS Bedrock Claude Sensitive Data in Prompts id: 39346724-a73a-4e01-8e93-4f4791e1a0bb version: 1 -author: Rod Soto -status: production creation_date: '2026-07-06' modification_date: '2026-07-06' -data_source: - - AWS Bedrock Claude +author: Rod Soto +status: production type: Anomaly description: This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. Exposure of sensitive data through AI prompts may indicate data loss, credential leakage, or insider threat activity. +data_source: + - AWS Bedrock Claude search: |- `aws_bedrock_claude` | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv, "accountId" AS account_id diff --git a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml index 9d1123e530..f3e883a80e 100644 --- a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml +++ b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml @@ -1,16 +1,14 @@ name: AWS Bedrock Claude Unusually Large Prompts id: 95fbdd4e-1202-4971-b85a-513b2005086e version: 2 +creation_date: '2026-07-06' +modification_date: '2026-07-08' author: Rod Soto status: production type: Anomaly -creation_date: '2026-07-06' -modification_date: '2026-07-08' -security_domain: endpoint +description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service. data_source: - AWS Bedrock Claude -category: application -description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service. search: |- `aws_bedrock_claude` | rename "input.inputTokenCount" AS input_tokens @@ -56,6 +54,8 @@ product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud +category: application +security_domain: endpoint tests: - name: True Positive Test test_type: unit diff --git a/detections/endpoint/linux_binary_launched_process_with_null_argv.yml b/detections/endpoint/linux_binary_launched_process_with_null_argv.yml index 6b1da8383a..9dec0940f7 100644 --- a/detections/endpoint/linux_binary_launched_process_with_null_argv.yml +++ b/detections/endpoint/linux_binary_launched_process_with_null_argv.yml @@ -48,6 +48,9 @@ finding: analytic_story: - Linux Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-43284 + - CVE-2026-43500 mitre_attack_id: - T1068 product: @@ -56,9 +59,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-43284 - - CVE-2026-43500 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/linux_malformed_auth_entry.yml b/detections/endpoint/linux_malformed_auth_entry.yml index d03f315473..79a8ec4f7f 100644 --- a/detections/endpoint/linux_malformed_auth_entry.yml +++ b/detections/endpoint/linux_malformed_auth_entry.yml @@ -55,6 +55,8 @@ intermediate_findings: analytic_story: - Linux Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-31431 mitre_attack_id: - T1068 product: @@ -63,8 +65,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-31431 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml b/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml index 588b2269fe..9350c9df39 100644 --- a/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml +++ b/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml @@ -45,6 +45,8 @@ finding: analytic_story: - Linux Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-31431 mitre_attack_id: - T1068 product: @@ -53,8 +55,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-31431 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/linux_suspicious_namespace_creation.yml b/detections/endpoint/linux_suspicious_namespace_creation.yml index 4f1edb94d0..86c010c4fe 100644 --- a/detections/endpoint/linux_suspicious_namespace_creation.yml +++ b/detections/endpoint/linux_suspicious_namespace_creation.yml @@ -91,6 +91,9 @@ finding: analytic_story: - Linux Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-43284 + - CVE-2026-43500 mitre_attack_id: - T1068 product: @@ -99,9 +102,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-43284 - - CVE-2026-43500 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml index 9efa95ae5a..7bb99a45b9 100644 --- a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml +++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml @@ -50,6 +50,8 @@ analytic_story: - Windows Privilege Escalation - BlueHammer asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 - T1543.003 @@ -59,8 +61,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml b/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml index 22f756fe00..fef62dc23f 100644 --- a/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml +++ b/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml @@ -53,6 +53,8 @@ analytic_story: - RedSun - Windows Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 product: @@ -61,8 +63,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_msmpeng_writing_to_system32.yml b/detections/endpoint/windows_msmpeng_writing_to_system32.yml index 77a9276794..5612c1f738 100644 --- a/detections/endpoint/windows_msmpeng_writing_to_system32.yml +++ b/detections/endpoint/windows_msmpeng_writing_to_system32.yml @@ -60,6 +60,8 @@ analytic_story: - BlueHammer - RedSun asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 - T1543.003 @@ -69,8 +71,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml index 3a889d8d33..f2a81e0116 100644 --- a/detections/endpoint/windows_non_system_process_querying_definition_update.yml +++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml @@ -55,6 +55,8 @@ analytic_story: - BlueHammer - RedSun asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 - T1071.001 @@ -64,8 +66,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_powershell_commands_from_dns_txt.yml b/detections/endpoint/windows_powershell_commands_from_dns_txt.yml index 04d20490fe..7db563b9a0 100644 --- a/detections/endpoint/windows_powershell_commands_from_dns_txt.yml +++ b/detections/endpoint/windows_powershell_commands_from_dns_txt.yml @@ -70,8 +70,8 @@ product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud -security_domain: endpoint category: endpoint +security_domain: endpoint tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml index b0d3a2986e..d8d495550e 100644 --- a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml +++ b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml @@ -71,6 +71,8 @@ analytic_story: - Windows Privilege Escalation - BlueHammer asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 product: @@ -79,8 +81,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml b/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml index 887533c621..7cf0819d97 100644 --- a/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml +++ b/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml @@ -97,6 +97,8 @@ analytic_story: - RedSun - Windows Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 product: @@ -105,8 +107,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml b/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml index a7c5c40ed2..6f5b06b99c 100644 --- a/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml +++ b/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml @@ -62,6 +62,8 @@ analytic_story: - Windows Privilege Escalation - BlueHammer asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 product: @@ -70,8 +72,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml index 2dbde3a76f..27fd49a215 100644 --- a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml +++ b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml @@ -59,6 +59,8 @@ analytic_story: - Windows Persistence Techniques - BlueHammer asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 - T1105 @@ -68,8 +70,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml b/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml index 6885fd4a79..93c761b557 100644 --- a/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml +++ b/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml @@ -57,6 +57,8 @@ analytic_story: - RedSun - Windows Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 product: @@ -65,8 +67,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/docs/ci/yaml_formatting.md b/docs/ci/yaml_formatting.md index f09fca5c84..cbc79a2dd3 100644 --- a/docs/ci/yaml_formatting.md +++ b/docs/ci/yaml_formatting.md @@ -43,7 +43,7 @@ Pre-commit hook runs automatically when you commit files in `detections/`: ```bash git add detections/endpoint/my_detection.yml git commit -m "Add detection" -# yamlfmt runs automatically +# yamlfmt and YAML field ordering run automatically ``` **Skip hook if needed:** @@ -65,6 +65,12 @@ yamlfmt detections/endpoint/my_detection.yml # Check what would change (dry run) yamlfmt -dry detections/ + +# Enforce configured root field order without changing other formatting +python scripts/enforce_yaml_field_order.py --fix detections/ + +# Check root field order only +python scripts/enforce_yaml_field_order.py --check detections/ ``` ### Validation (CI) @@ -118,7 +124,8 @@ pre-commit autoupdate - Check the script output for specific errors - Run locally: `python scripts/validate_yaml.py detections/` -- Ensure files pass both yamllint and yamlfmt --lint +- Ensure files pass yamllint, yamlfmt --lint, and configured root field ordering +- Fix field order locally: `python scripts/enforce_yaml_field_order.py --fix detections/` --- @@ -126,4 +133,5 @@ pre-commit autoupdate - `.yamlfmt` - yamlfmt formatting rules (4-space indent, LF line endings) - `.yamllint` - yamllint validation rules (syntax checks, no duplicate keys) +- `.yamlfieldorder` - Root field order for detection YAML files - `.pre-commit-config.yaml` - Pre-commit hook configuration diff --git a/scripts/enforce_yaml_field_order.py b/scripts/enforce_yaml_field_order.py new file mode 100644 index 0000000000..c23926d949 --- /dev/null +++ b/scripts/enforce_yaml_field_order.py @@ -0,0 +1,382 @@ +#!/usr/bin/env python3 +""" +Preserve-format YAML root field ordering. + +The script only moves complete top-level YAML blocks. It does not parse and +dump YAML, so indentation, spaces, scalar style, comments, and nested content +inside each field block stay exactly as they were. +""" + +import argparse +import re +import subprocess +import sys +from dataclasses import dataclass +from pathlib import Path +from typing import Dict, Iterable, List, Optional, Sequence, Tuple + + +BOM = b"\xef\xbb\xbf" +ROOT_KEY_RE = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)\s*:(?:\s.*)?(?:\r?\n)?$") + + +class ConfigError(ValueError): + """Raised when the field-order config cannot be read.""" + + +class FieldOrderError(ValueError): + """Raised when a YAML file cannot be safely reordered.""" + + +@dataclass(frozen=True) +class FieldOrderConfig: + target_paths: Tuple[str, ...] + extensions: Tuple[str, ...] + root_field_order: Tuple[str, ...] + unknown_fields: str = "append" + + +@dataclass(frozen=True) +class RootBlock: + key: str + lines: Tuple[str, ...] + line_number: int + + +@dataclass(frozen=True) +class OrderedText: + text: str + current_keys: Tuple[str, ...] + desired_keys: Tuple[str, ...] + + +@dataclass(frozen=True) +class FileOrderResult: + path: Path + changed: bool + detail: Optional[str] = None + error: Optional[str] = None + + +def find_repo_root() -> Path: + try: + result = subprocess.run( + ["git", "rev-parse", "--show-toplevel"], + capture_output=True, + text=True, + check=True, + ) + return Path(result.stdout.strip()) + except (subprocess.CalledProcessError, FileNotFoundError): + return Path.cwd() + + +def parse_scalar(value: str) -> str: + value = value.strip() + if len(value) >= 2 and value[0] == value[-1] and value[0] in {"'", '"'}: + return value[1:-1] + return value + + +def parse_simple_yaml_config(config_path: Path) -> Dict[str, object]: + data: Dict[str, object] = {} + current_key: Optional[str] = None + + for lineno, raw_line in enumerate(config_path.read_text(encoding="utf-8").splitlines(), start=1): + line = raw_line.strip() + if not line or line.startswith("#"): + continue + + if line.startswith("- "): + if current_key is None or not isinstance(data.get(current_key), list): + raise ConfigError(f"{config_path}:{lineno}: list item without a list key") + item = parse_scalar(line[2:]) + if not item: + raise ConfigError(f"{config_path}:{lineno}: empty list item") + data[current_key].append(item) # type: ignore[index] + continue + + if ":" not in line: + raise ConfigError(f"{config_path}:{lineno}: expected 'key:' or 'key: value'") + + key, value = line.split(":", 1) + key = key.strip() + value = value.strip() + if not key: + raise ConfigError(f"{config_path}:{lineno}: empty key") + + if value: + data[key] = parse_scalar(value) + current_key = None + else: + data[key] = [] + current_key = key + + return data + + +def as_string_list(data: Dict[str, object], key: str, default: Sequence[str]) -> Tuple[str, ...]: + value = data.get(key, list(default)) + if isinstance(value, str): + return (value,) + if not isinstance(value, list) or not all(isinstance(item, str) for item in value): + raise ConfigError(f"Config key '{key}' must be a string or list of strings") + return tuple(value) + + +def load_config(config_path: Path) -> FieldOrderConfig: + if not config_path.exists(): + raise ConfigError(f"Field-order config not found: {config_path}") + + data = parse_simple_yaml_config(config_path) + root_field_order = data.get("root_field_order", data.get("field_order")) + if not isinstance(root_field_order, list) or not all(isinstance(item, str) for item in root_field_order): + raise ConfigError("Config key 'root_field_order' must be a list of field names") + + duplicate_fields = sorted({field for field in root_field_order if root_field_order.count(field) > 1}) + if duplicate_fields: + raise ConfigError(f"Duplicate field(s) in root_field_order: {', '.join(duplicate_fields)}") + + target_paths = as_string_list(data, "target_paths", ["detections/"]) + extensions = as_string_list(data, "extensions", [".yml", ".yaml"]) + normalized_extensions = tuple(ext if ext.startswith(".") else f".{ext}" for ext in extensions) + + unknown_fields = data.get("unknown_fields", "append") + if not isinstance(unknown_fields, str): + raise ConfigError("Config key 'unknown_fields' must be a string") + if unknown_fields not in {"append", "fail"}: + raise ConfigError("Config key 'unknown_fields' must be either 'append' or 'fail'") + + return FieldOrderConfig( + target_paths=tuple(normalize_target_path(path) for path in target_paths), + extensions=normalized_extensions, + root_field_order=tuple(root_field_order), + unknown_fields=unknown_fields, + ) + + +def normalize_target_path(path: str) -> str: + normalized = path.replace("\\", "/").strip("/") + return normalized + + +def relative_to_repo(path: Path, repo_root: Path) -> Path: + absolute_path = path if path.is_absolute() else repo_root / path + try: + return absolute_path.resolve().relative_to(repo_root.resolve()) + except ValueError: + return path + + +def path_matches_config(path: Path, repo_root: Path, config: FieldOrderConfig) -> bool: + if path.suffix not in config.extensions: + return False + + rel_path = relative_to_repo(path, repo_root) + rel_posix = rel_path.as_posix().strip("/") + return any(rel_posix == target or rel_posix.startswith(f"{target}/") for target in config.target_paths) + + +def find_yaml_files(paths: Sequence[str], repo_root: Path, config: FieldOrderConfig) -> List[Path]: + found: List[Path] = [] + + for path_str in paths: + path = Path(path_str) + path = path if path.is_absolute() else repo_root / path + + if path.is_file(): + if path_matches_config(path, repo_root, config): + found.append(path) + continue + + if path.is_dir(): + for extension in config.extensions: + for yaml_file in path.rglob(f"*{extension}"): + if path_matches_config(yaml_file, repo_root, config): + found.append(yaml_file) + + return sorted(set(found), key=lambda item: relative_to_repo(item, repo_root).as_posix()) + + +def split_root_blocks(text: str) -> Tuple[Tuple[str, ...], Tuple[RootBlock, ...]]: + lines = tuple(text.splitlines(keepends=True)) + starts: List[Tuple[int, str]] = [] + + for index, line in enumerate(lines): + match = ROOT_KEY_RE.match(line) + if match: + starts.append((index, match.group(1))) + + if not starts: + return lines, tuple() + + preamble = lines[: starts[0][0]] + blocks: List[RootBlock] = [] + seen: Dict[str, int] = {} + duplicates: List[str] = [] + + for index, (start, key) in enumerate(starts): + end = starts[index + 1][0] if index + 1 < len(starts) else len(lines) + if key in seen: + duplicates.append(f"{key} at lines {seen[key]} and {start + 1}") + else: + seen[key] = start + 1 + blocks.append(RootBlock(key=key, lines=lines[start:end], line_number=start + 1)) + + if duplicates: + raise FieldOrderError(f"Duplicate root field(s): {', '.join(duplicates)}") + + return preamble, tuple(blocks) + + +def render_ordered_text(text: str, config: FieldOrderConfig) -> OrderedText: + preamble, blocks = split_root_blocks(text) + if not blocks: + return OrderedText(text=text, current_keys=tuple(), desired_keys=tuple()) + + block_by_key = {block.key: block for block in blocks} + ordered_blocks: List[RootBlock] = [] + used_keys = set() + + for key in config.root_field_order: + block = block_by_key.get(key) + if block is not None: + ordered_blocks.append(block) + used_keys.add(key) + + unknown_blocks = [block for block in blocks if block.key not in used_keys] + if unknown_blocks and config.unknown_fields == "fail": + unknown_keys = ", ".join(block.key for block in unknown_blocks) + raise FieldOrderError(f"Unknown root field(s) not configured: {unknown_keys}") + + ordered_blocks.extend(unknown_blocks) + + rendered_lines: List[str] = list(preamble) + for block in ordered_blocks: + rendered_lines.extend(block.lines) + + return OrderedText( + text="".join(rendered_lines), + current_keys=tuple(block.key for block in blocks), + desired_keys=tuple(block.key for block in ordered_blocks), + ) + + +def describe_difference(current_keys: Sequence[str], desired_keys: Sequence[str]) -> str: + for index, (current, desired) in enumerate(zip(current_keys, desired_keys), start=1): + if current != desired: + return f"position {index}: found '{current}', expected '{desired}'" + if len(current_keys) != len(desired_keys): + return "root field set changed during ordering" + return "root fields are not in configured order" + + +def read_utf8_bytes(path: Path) -> Tuple[str, bool]: + raw = path.read_bytes() + has_bom = raw.startswith(BOM) + if has_bom: + raw = raw[len(BOM) :] + try: + return raw.decode("utf-8"), has_bom + except UnicodeDecodeError as exc: + raise FieldOrderError(f"File is not valid UTF-8: {exc}") from exc + + +def write_utf8_bytes(path: Path, text: str, has_bom: bool) -> None: + raw = text.encode("utf-8") + if has_bom: + raw = BOM + raw + path.write_bytes(raw) + + +def process_file(path: Path, config: FieldOrderConfig, fix: bool = False) -> FileOrderResult: + try: + original_text, has_bom = read_utf8_bytes(path) + ordered = render_ordered_text(original_text, config) + except (OSError, FieldOrderError) as exc: + return FileOrderResult(path=path, changed=False, error=str(exc)) + + changed = ordered.text != original_text + if changed and fix: + try: + write_utf8_bytes(path, ordered.text, has_bom) + except OSError as exc: + return FileOrderResult(path=path, changed=False, error=str(exc)) + + detail = describe_difference(ordered.current_keys, ordered.desired_keys) if changed else None + return FileOrderResult(path=path, changed=changed, detail=detail) + + +def display_path(path: Path, repo_root: Path) -> str: + try: + return relative_to_repo(path, repo_root).as_posix() + except OSError: + return str(path) + + +def print_results(results: Sequence[FileOrderResult], repo_root: Path, fix: bool) -> int: + errors = [result for result in results if result.error] + changed = [result for result in results if result.changed] + + if errors: + print("[FAIL] Field-order check could not process some file(s):") + for result in errors: + print(f" - {display_path(result.path, repo_root)}: {result.error}") + + if changed and fix: + print(f"[OK] Reordered root fields in {len(changed)} file(s):") + for result in changed: + print(f" - {display_path(result.path, repo_root)}") + elif changed: + print(f"[FAIL] Root fields are not in configured order in {len(changed)} file(s):") + for result in changed: + detail = f": {result.detail}" if result.detail else "" + print(f" - {display_path(result.path, repo_root)}{detail}") + print("\n[TIP] Run: python scripts/enforce_yaml_field_order.py --fix detections/") + + if not errors and not changed: + print(f"[PASS] Root field order is valid for {len(results)} file(s)") + + return 1 if errors or (changed and not fix) else 0 + + +def main(argv: Optional[Sequence[str]] = None) -> int: + parser = argparse.ArgumentParser( + description="Check or fix top-level YAML field order without changing field formatting.", + formatter_class=argparse.RawDescriptionHelpFormatter, + epilog="""Examples: + python scripts/enforce_yaml_field_order.py --check detections/ + python scripts/enforce_yaml_field_order.py --fix detections/endpoint/file.yml + python scripts/enforce_yaml_field_order.py --config .yamlfieldorder --check detections/ +""", + ) + mode = parser.add_mutually_exclusive_group() + mode.add_argument("--check", action="store_true", help="Verify field order without changing files (default)") + mode.add_argument("--fix", action="store_true", help="Rewrite files with configured root field order") + parser.add_argument("--config", default=".yamlfieldorder", help="Path to field-order config") + parser.add_argument("paths", nargs="*", help="YAML files or directories to process") + + args = parser.parse_args(argv) + repo_root = find_repo_root() + config_path = Path(args.config) + if not config_path.is_absolute(): + config_path = repo_root / config_path + + try: + config = load_config(config_path) + except ConfigError as exc: + print(f"[ERROR] {exc}") + return 1 + + input_paths = args.paths if args.paths else list(config.target_paths) + yaml_files = find_yaml_files(input_paths, repo_root, config) + if not yaml_files: + print("[PASS] No configured YAML files found") + return 0 + + results = [process_file(path, config, fix=args.fix) for path in yaml_files] + return print_results(results, repo_root, fix=args.fix) + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/validate_yaml.py b/scripts/validate_yaml.py index f946d1fdc5..4913a97480 100644 --- a/scripts/validate_yaml.py +++ b/scripts/validate_yaml.py @@ -1,7 +1,7 @@ #!/usr/bin/env python3 """ CI Validation Script for YAML Files -Runs yamllint and yamlfmt --lint with beautified error output +Runs yamllint, yamlfmt --lint, and root field-order checks with beautified error output Usage: python scripts/validate_yaml.py [path_to_yaml_files...] """ import argparse @@ -10,6 +10,9 @@ from pathlib import Path from typing import List, Tuple, Optional +from enforce_yaml_field_order import load_config as load_field_order_config +from enforce_yaml_field_order import process_file as process_field_order_file + def find_yamlfmt(custom_path: Optional[str] = None) -> Optional[str]: """Find yamlfmt executable in common locations or use custom path @@ -228,10 +231,37 @@ def run_yamlfmt_lint(files: List[Path], config: Path, yamlfmt_path: Optional[str return all_passed, all_unformatted_files +def run_field_order_lint(files: List[Path], config: Path) -> Tuple[bool, dict]: + """Run root field-order check on files and return success status and errors by file + + Returns: + Tuple of (success, file_errors_dict) + """ + if not files: + return True, {} + + try: + field_order_config = load_field_order_config(config) + except Exception as exc: + return False, {str(config): [str(exc)]} + + file_errors = {} + + for yaml_file in files: + result = process_field_order_file(yaml_file, field_order_config, fix=False) + if result.error: + file_errors[str(yaml_file)] = [f"Field-order check failed: {result.error}"] + elif result.changed: + detail = f" ({result.detail})" if result.detail else "" + file_errors[str(yaml_file)] = [f"Root field order differs from .yamlfieldorder{detail}"] + + return not file_errors, file_errors + + def main(): """Main entry point""" parser = argparse.ArgumentParser( - description='Validate YAML files with yamllint and yamlfmt', + description='Validate YAML files with yamllint, yamlfmt, and root field ordering', formatter_class=argparse.RawDescriptionHelpFormatter, epilog=r""" Examples: @@ -281,6 +311,7 @@ def main(): # Find config files yamllint_config = repo_root / '.yamllint' yamlfmt_config = repo_root / '.yamlfmt' + field_order_config = repo_root / '.yamlfieldorder' if not yamllint_config.exists(): print_error(f".yamllint config not found at {yamllint_config}") @@ -289,6 +320,10 @@ def main(): if not yamlfmt_config.exists(): print_error(f".yamlfmt config not found at {yamlfmt_config}") return 1 + + if not field_order_config.exists(): + print_error(f".yamlfieldorder config not found at {field_order_config}") + return 1 # Find YAML files yaml_files = find_yaml_files(args.paths) @@ -301,9 +336,10 @@ def main(): print_header("Validating YAML Files") - # Run both validations + # Run validations yamllint_passed, yamllint_errors = run_yamllint(yaml_files, yamllint_config) yamlfmt_passed, yamlfmt_files = run_yamlfmt_lint(yaml_files, yamlfmt_config, args.yamlfmt_path) + field_order_passed, field_order_errors = run_field_order_lint(yaml_files, field_order_config) # Combine results by file all_issues = {} # file_path -> list of errors @@ -319,6 +355,12 @@ def main(): if file_path not in all_issues: all_issues[file_path] = [] all_issues[file_path].append("Formatting differences detected") + + # Add field-order issues + for file_path, errors in field_order_errors.items(): + if file_path not in all_issues: + all_issues[file_path] = [] + all_issues[file_path].extend(errors) # Display combined results if not all_issues: @@ -338,8 +380,10 @@ def main(): # Show fix instructions print(f"{Colors.CYAN}[TIP] To fix these issues, run:{Colors.RESET}") print(f" {Colors.BOLD}yamlfmt -conf .yamlfmt detections/{Colors.RESET}") + print(f" {Colors.BOLD}python scripts/enforce_yaml_field_order.py --fix detections/{Colors.RESET}") print(f"\n{Colors.CYAN} Or for specific files:{Colors.RESET}") print(f" {Colors.BOLD}yamlfmt -conf .yamlfmt {Colors.RESET}\n") + print(f" {Colors.BOLD}python scripts/enforce_yaml_field_order.py --fix {Colors.RESET}\n") return 1 From 0d6f6bfb28bbd8f1a8ac059864178f15d66b72e2 Mon Sep 17 00:00:00 2001 From: Samuel Owusu Date: Wed, 19 Aug 2026 07:05:24 -0500 Subject: [PATCH 074/164] docs: fix README grammar and wording (#4227) Corrected typos and improved clarity in the README. --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index e01cf2677f..340b89cf32 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,7 @@ This project gives you access to our repository of Analytic Stories, security gu - [Splunk Attack Range](https://github.com/splunk/attack_range): The Splunk Attack Range is an open-source project maintained by the Splunk Threat Research Team. It builds instrumented cloud (AWS, Azure) and local environments (Virtualbox), simulates attacks, and forwards the data into a Splunk instance. This environment can then be used to develop and test the effectiveness of detections. - [contentctl-ng](https://pypi.org/project/contentctl-ng/): The tool that enables us to build, test, and package our content for distribution. -- [Attack data](https://github.com/splunk/attack_data): The is a collection of attack data that is used to test our content. +- [Attack data](https://github.com/splunk/attack_data): This is a collection of attack data that is used to test our content. - [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team): Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. # Get Content🛡 @@ -55,12 +55,12 @@ Follow these steps to get started with Splunk Security Content. 1. Clone this repository using `git clone https://github.com/splunk/security_content.git` 2. Navigate to the repository directory using `cd security_content` -3. Install contentctl-ng using `pip install contentctl-ng` to install the latest version of contentctl-ng, this is a pre-requisite to validate, build and test the content like the Splunk Threat Research team -4. Install pre-commit using `pip install pre-commit` then proceed to installing the hooks via `pre-commit install`. this is a pre-requisite to validate and apply the proper formatting. +3. Install contentctl-ng using `pip install contentctl-ng` to install the latest version of contentctl-ng, this is a prerequisite to validate, build, and test the content like the Splunk Threat Research team +4. Install pre-commit using `pip install pre-commit` then proceed to installing the hooks via `pre-commit install`. This is a prerequisite to validate and apply the proper formatting. # Quick Start 🚀 -1. Setup the environment +1. Set up the environment ``` git clone https://github.com/splunk/security_content.git cd security_content @@ -95,9 +95,9 @@ https://github.com/user-attachments/assets/1be02afa-36b5-4d49-91cb-8ebbcf4123d0 - 🚨 NOTE: If you are just getting started with managing your Splunk detection as code, we recommend that you keep the YML structure of the detections as close as possible to the original structure of the detections. This will make it easier to manage your detections and will also make it easier to contribute back to the community by creating a pull request to the Splunk Security Content project. -- In order to build an content app that specific for your organization, we strongly recommend that you start with keeping only the detections that are related to your organization and remove other YML files that are not related to your organization. This includes selecting detections, stories, macros, lookups that are used by the detection YML files. +- In order to build a content app that specific for your organization, we strongly recommend that you start with keeping only the detections that are related to your organization and remove other YML files that are not related to your organization. This includes selecting detections, stories, macros, lookups that are used by the detection YML files. -- If your detections are using macros and lookups, please make sure that you have the same macros and lookups in those directories.. This will ensure that the content app is self-contained and does not rely on external files. +- If your detections are using macros and lookups, please make sure that you have the same macros and lookups in those directories. This will ensure that the content app is self-contained and does not rely on external files. - We recommend that you follow the errors produced by the `contentctl-ng` tool while developing this content. The errors are descriptive enough to guide you in getting the right values. If you need help, please refer to the [JSON Schemas](#json-schemas) to check out the list of allowed values From 4fede6c7c02091185e4187865117b4ef41734d73 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Wed, 19 Aug 2026 21:29:40 +0200 Subject: [PATCH 075/164] Add Content and Tagging for Vidar Stealer (#4217) --------- Co-authored-by: Teoderick Contreras Co-authored-by: Bhavin Patel Co-authored-by: Nasreddine Bencherchali --- ..._or_script_creation_in_suspicious_path.yml | 5 +- ...tables_or_script_creation_in_temp_path.yml | 5 +- ...e_process_accessing_chrome_default_dir.yml | 5 +- ...fox_process_access_firefox_profile_dir.yml | 5 +- ...ss_token_manipulation_sedebugprivilege.yml | 5 +- ...e_file_read_access_by_uncommon_process.yml | 109 ++++++++++++++++++ ...assword_stores_chrome_extension_access.yml | 5 +- ...ssword_stores_chrome_localstate_access.yml | 5 +- ...ssword_stores_chrome_login_data_access.yml | 5 +- ...indows_disable_or_stop_browser_process.yml | 5 +- .../windows_indicator_removal_via_rmdir.yml | 5 +- ...indows_process_injection_remote_thread.yml | 5 +- ..._query_registry_uninstall_program_list.yml | 5 +- .../windows_screen_capture_in_temp_folder.yml | 5 +- .../windows_suspicious_process_file_path.yml | 5 +- stories/vidar_stealer.yml | 34 ++++++ 16 files changed, 185 insertions(+), 28 deletions(-) create mode 100644 detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml create mode 100644 stories/vidar_stealer.yml diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index e3e6d3cee1..88b6fb4b74 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 30 +version: 31 creation_date: '2021-05-07' -modification_date: '2026-07-20' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -140,6 +140,7 @@ analytic_story: - VIP Keylogger - Phantom Stealer - Starland RAT Campaign + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 6f4f9aa1ce..69962abd69 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 26 +version: 27 creation_date: '2021-05-07' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -133,6 +133,7 @@ analytic_story: - RoguePlanet - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 9eed7ce0f7..7c4d31481c 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,8 +1,8 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: 20 +version: 21 creation_date: '2021-09-15' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,6 +51,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index bdd370d7ef..87b1884b1c 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,8 +1,8 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: 20 +version: 21 creation_date: '2021-09-15' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,6 +53,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index d3b92a9ed6..cee3e655c7 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -1,8 +1,8 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 -version: 23 +version: 24 creation_date: '2022-09-05' -modification_date: '2026-06-08' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,6 +53,7 @@ analytic_story: - Tuoni - Gh0st RAT - Salat Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1134.002 diff --git a/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml b/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml new file mode 100644 index 0000000000..bf909972d7 --- /dev/null +++ b/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml @@ -0,0 +1,109 @@ +name: Windows Cloud Sensitive File Read Access By Uncommon Process +id: 313e4f5c-add3-4b4d-8348-6a009ce5fe40 +version: 1 +creation_date: '2026-08-19' +modification_date: '2026-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints. + It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure. + Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants. + This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future. +data_source: + - Windows Event Log Security 4663 +search: |- + `wineventlog_security` + EventCode=4663 + ObjectType="File" + NOT process_path IN ( + "*:\\AppData\\Local\\Programs\\Python\\*\\python.exe", + "*:\\AppData\\Local\\Python\\bin\\python.exe", + "*:\\AppData\\Local\\Python\\pythoncore-*\\python.exe", + "*:\\Program Files\\Azure Dev CLI\\azd.exe", + "*:\\Program Files\\Microsoft SDKs\\Azure\\CLI2\\python.exe", + "*:\\Program Files\\Microsoft VS Code\\Code.exe", + "*:\\Program Files\\nodejs\\node.exe", + "*:\\Program Files\\PowerShell\\7-preview\\pwsh.exe", + "*:\\Program Files\\PowerShell\\7\\pwsh.exe", + "*:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", + "*:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "*\\.azd\\bin\\azd.exe", + "*\\AppData\\Local\\Microsoft\\powershell\\pwsh.exe", + "*\\AppData\\Local\\Programs\\Azure Dev CLI\\azd.exe", + "*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe" + ) + ObjectName IN ( + "*\\.azure\\accessTokens.json", + "*\\.azure\\azureProfile.json", + "*\\.azure\\msal_token_cache.json", + "*\\.azure\\TokenCache.dat", + "*\\Windows Azure Powershell\\TokenCache.dat" + ) + + ``` + We select only read-related operations: + 0x1 = ReadData (or ListDirectory) + ``` + + | eval AccessMask_ = tonumber(AccessMask, 16) + | where (bit_and(AccessMask_, 1) != 0) + + | stats count min(_time) as firstTime + max(_time) as lastTime + by signature_id signature + ObjectType file_path file_name + process_path process_name process_id + AccessMask src_user dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_cloud_sensitive_file_read_access_by_uncommon_process_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + To enable Event ID 4663, enable object access auditing through Group Policy: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access > Audit File System, then enable Success auditing. Enable Failure auditing if your environment also requires denied access attempts. + Event ID 4663 is only generated for files with a matching System Access Control List (SACL), so configure auditing on the relevant sensitive files from cloud providers. +known_false_positives: |- + False positives are expected from legitimate tooling. + The detection excludes the Azure CLI bundled Python interpreter, Windows PowerShell, PowerShell 7+, VS Code, and the Azure Developer CLI by process path. + Residual false positives may arise from CI/CD agents (e.g., Azure DevOps self-hosted runners, GitHub Actions runners) that invoke az or Azure PowerShell from non-standard install paths not covered by the exclusion list, backup or DLP agents that scan user profile directories, and custom automation scripts that shell out to Azure CLI from an unexpected working directory. + Tune by adding confirmed-legitimate process paths and file paths to the companion filter macro windows_cloud_sensitive_file_read_access_by_uncommon_process_filter. +references: + - https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: An uncommon process [$process_name$] accessing sensitive file [$file_path$] with AccessMask [$AccessMask$] on $dest$ +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Vidar Stealer +asset_type: Endpoint +mitre_attack_id: + - T1528 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/vidar_azure_file_access/azure_vidar_access.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml index e4f8a81b82..231b1b6cbb 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome Extension Access id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af -version: 13 +version: 14 creation_date: '2023-05-02' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -71,6 +71,7 @@ analytic_story: - 0bj3ctivity Stealer - BlankGrabber Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 20b4759d21..1d58baaa71 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: 23 +version: 24 creation_date: '2023-05-02' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -85,6 +85,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 57cf84d660..5656489fbe 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: 23 +version: 24 creation_date: '2023-05-02' -modification_date: '2026-07-08' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -85,6 +85,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index 51490b8924..354d3e7a7d 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -1,8 +1,8 @@ name: Windows Disable or Stop Browser Process id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5 -version: 14 +version: 15 creation_date: '2024-10-18' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -57,6 +57,7 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/windows_indicator_removal_via_rmdir.yml b/detections/endpoint/windows_indicator_removal_via_rmdir.yml index fdeaac6b08..e86c4aa350 100644 --- a/detections/endpoint/windows_indicator_removal_via_rmdir.yml +++ b/detections/endpoint/windows_indicator_removal_via_rmdir.yml @@ -1,8 +1,8 @@ name: Windows Indicator Removal Via Rmdir id: c4566d2c-b094-48a1-9c59-d66e22065560 -version: 12 +version: 13 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -35,6 +35,7 @@ analytic_story: - DarkGate Malware - APT37 Rustonotto and FadeStealer - ZOVWiper + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1070 diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index e50e55a325..3a06b8b7ed 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,8 +1,8 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 -version: 14 +version: 15 creation_date: '2022-10-28' -modification_date: '2026-06-29' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -72,6 +72,7 @@ analytic_story: - Earth Alux - Water Gamayun - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1055.002 diff --git a/detections/endpoint/windows_query_registry_uninstall_program_list.yml b/detections/endpoint/windows_query_registry_uninstall_program_list.yml index d2f45279fe..d1ac45a907 100644 --- a/detections/endpoint/windows_query_registry_uninstall_program_list.yml +++ b/detections/endpoint/windows_query_registry_uninstall_program_list.yml @@ -1,8 +1,8 @@ name: Windows Query Registry UnInstall Program List id: 535fd4fc-7151-4062-9d7e-e896bea77bf6 -version: 10 +version: 11 creation_date: '2023-05-02' -modification_date: '2026-05-13' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -33,6 +33,7 @@ analytic_story: - StealC Stealer - RedLine Stealer - Meduza Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_screen_capture_in_temp_folder.yml b/detections/endpoint/windows_screen_capture_in_temp_folder.yml index 02e18be49a..c9aa8093d1 100644 --- a/detections/endpoint/windows_screen_capture_in_temp_folder.yml +++ b/detections/endpoint/windows_screen_capture_in_temp_folder.yml @@ -1,8 +1,8 @@ name: Windows Screen Capture in TEMP folder id: 00524d1f-a032-46f5-9108-e7d9f01bfb3c -version: 12 +version: 13 creation_date: '2024-10-18' -modification_date: '2026-05-13' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -37,6 +37,7 @@ analytic_story: - APT37 Rustonotto and FadeStealer - Hellcat Ransomware - VIP Keylogger + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1113 diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 48ec64c62e..bae7c63144 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 27 +version: 28 creation_date: '2021-05-07' -modification_date: '2026-07-20' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -97,6 +97,7 @@ analytic_story: - RoguePlanet - Phantom Stealer - Starland RAT Campaign + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/stories/vidar_stealer.yml b/stories/vidar_stealer.yml new file mode 100644 index 0000000000..7ff25c7085 --- /dev/null +++ b/stories/vidar_stealer.yml @@ -0,0 +1,34 @@ +name: Vidar Stealer +id: 220047e4-6075-40bc-846f-ab737e6a4dc8 +version: 1 +creation_date: '2026-07-31' +modification_date: '2026-07-31' +author: Teoderick Contreras, Splunk +status: production +description: |- + The Vidar Stealer analytic story provides detection and investigation content for identifying and responding to threats associated with the Vidar information stealer on Windows endpoints. + Vidar is a commodity infostealer sold as malware-as-a-service (MaaS) on underground forums, capable of harvesting credentials, browser cookies, saved passwords, cryptocurrency wallet data, and cloud profile metadata from infected systems. + Recent variants have been observed targeting Azure CLI profile data stored in azureProfile.json, enabling cloud identity reconnaissance and potential account takeover. + Vidar also loads legitimate Mozilla NSS and mozglue DLLs to decrypt browser-stored credentials without raising typical AV signatures. + This story leverages endpoint telemetry from Windows Security Event logs and Sysmon to detect suspicious file access, unusual DLL loading patterns, and process behaviors consistent with Vidar activity. + Security teams can use these analytics to identify early-stage Vidar compromise, isolate affected hosts, and prevent credential exfiltration to attacker-controlled command-and-control infrastructure. +narrative: |- + Vidar Stealer is an active commodity threat targeting Windows users across multiple sectors, distributed primarily through phishing campaigns, malvertising, trojanized software downloads, and cracked application bundles. + Once executed, Vidar performs rapid system and credential reconnaissance before exfiltrating harvested data to its command-and-control (C2) server, often within minutes of initial execution. + A notable capability of Vidar is its abuse of legitimate Mozilla NSS libraries (nss3.dll, mozglue.dll) to decrypt browser-stored credentials from Chromium and Firefox-based browsers without triggering conventional security controls. + By side-loading these trusted DLLs from an unexpected process context, Vidar bypasses many endpoint detection signatures that rely on browser process lineage. + More recent Vidar variants have extended their reconnaissance scope to include Azure CLI artifacts, specifically targeting the azureProfile.json file stored in the user profile directory. + This file contains Azure subscription identifiers, tenant IDs, and environment metadata that attackers can use to enumerate accessible cloud resources and facilitate lateral movement into Azure-hosted infrastructure. + Telemetry from affected endpoints typically shows non-Azure processes opening azureProfile.json with read access (Event 4663, AccessMask 0x1), followed by data staging and outbound HTTPS exfiltration. + Detection of these behaviors early in the infection chain gives defenders the opportunity to contain the compromise before credentials reach attacker infrastructure, preventing downstream account takeovers, financial fraud, and secondary malware deployment. +references: + - https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html + - https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar + - https://www.esentire.com/blog/vidar-stealer-abusing-social-media-for-c2 +category: + - Malware +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection From 8370dddf1187cfa042cb4b51a7fea2751671d334 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 20 Aug 2026 01:17:01 -0700 Subject: [PATCH 076/164] Update data source TA and install.yml app versions (#4228) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- 62 files changed, 62 insertions(+), 62 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 4607235dc4..177d51fa85 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index b63f18820d..801a3882ea 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index e0143b8282..e725a27c95 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 825b34c64b..9ce661d969 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index 12129d2b6c..87c2702b27 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 11f6b92811..1c5f94ecab 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 31d80aad7b..042284fe75 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 43dd2a556e..90d25a6c4b 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 129a3a1fb5..66946e9161 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index bce7344352..e9c79a8b1a 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index c7f5b9a219..c1153a3068 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 87f204eb6f..00c450ca5d 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index fbc4851ba9..621812b8ec 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index d8910cfa60..f84b2cf002 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 2270baea06..bcc8f0593c 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index f1f93bb50a..9c87fc438a 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index b81255026c..4364c10000 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 5713917371..9aa2841257 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index a093e8e01c..39d29d1a6f 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index e0ec05a9f5..d190093d91 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index a267a7365b..bcf4fd5f84 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 49aaff4b2a..6cb149284f 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 4c8f1145d8..0bacc4bbb4 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 805f634c52..d8aa0af29a 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 71f8b3e5cd..32a576295d 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index e79e168f52..fb8e5147f6 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 1ecf190e17..6518df5b56 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 4b95dba5c9..26b3ce7198 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index d49419a496..f5c3a384fe 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index af9675c580..95f67eb714 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 6337447b95..888baf1d85 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index 23e8cfc587..e8eb028bb9 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 8069985786..2a0af88997 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index c192eec08f..bd587aed86 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 9f8e54c0b0..3d389b31f6 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 84df312158..5aa835619d 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index ffb232cf7d..191afb2bce 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 7f8a42b305..e31315d18c 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 36d941e095..27e9e0b3f1 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 8fb94ecdd2..160dfe1db5 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index b40bdbc8aa..4c419b3a63 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index 14a6f7bf67..d2d1b63ce6 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index 40b994aea0..c421ba7cb9 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 405e216639..f3898a6679 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index d058bd83b4..3613f843e8 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index ee76b1b6c4..4d47df2492 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 8befb435c8..1027f7c5f2 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index bf63205891..4877ea119c 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index 883fb202b5..daa93d4c05 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index b071d6907d..452914db25 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index d3f179ec63..ebcd3e95b4 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index e92163adc2..d95a8e337f 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 8155bef777..57b95d703a 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 92c5655c6c..40e4c9ae5d 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 4e07364aa9..83e554a5ca 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 9c3ec05bf8..de9423c9c5 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 0f07c4ba64..106b623c2c 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index bb02c750ca..f62c9e6417 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 6d8968e44d..e8c6c5ae94 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index 3455d837c4..c609919c95 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index 2bf501a18b..b165f0ace8 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.2.1 + version: 8.2.2 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index a74705eac4..64fc6abb3b 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - AwsAccountId From a2f99be2f5c340d84aae86a8e182d1e68bb7dfd3 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Thu, 20 Aug 2026 16:28:10 +0200 Subject: [PATCH 077/164] Add New Detections Covering ShieldBreak Exploitation (#4222) --------- Co-authored-by: Nasreddine Bencherchali --- .../windows_event_log_defender_1116.yml | 89 ++++++++++++++ .../windows_event_log_defender_1117.yml | 93 +++++++++++++++ ...e_data_stream_created_over_local_share.yml | 83 +++++++++++++ ...r_protocol_wermgr_connect_to_namedpipe.yml | 6 +- ...ent_dll_loaded_by_non_defender_process.yml | 86 ++++++++++++++ ..._threat_detected_on_kernel_object_path.yml | 76 ++++++++++++ ...report_created_in_reportqueue_manually.yml | 84 +++++++++++++ .../windows_phantom_dll_created_on_disk.yml | 111 ++++++++++++++++++ ...process_injection_wermgr_child_process.yml | 5 +- ...rmgr_spawning_system_integrity_process.yml | 90 ++++++++++++++ stories/rogueplanet.yml | 17 ++- 11 files changed, 732 insertions(+), 8 deletions(-) create mode 100644 data_sources/windows_event_log_defender_1116.yml create mode 100644 data_sources/windows_event_log_defender_1117.yml create mode 100644 detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml create mode 100644 detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml create mode 100644 detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml create mode 100644 detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml create mode 100644 detections/endpoint/windows_phantom_dll_created_on_disk.yml create mode 100644 detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml new file mode 100644 index 0000000000..9b02654eb1 --- /dev/null +++ b/data_sources/windows_event_log_defender_1116.yml @@ -0,0 +1,89 @@ +name: Windows Event Log Defender 1116 +id: 588d6a99-14eb-4061-aec3-55cc54d11d6b +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-17' +author: Onur Mustafa Erdogan, Splunk +description: Logs an event when a Windows Defender detects a malware or potentially unwanted software. +mitre_components: + - Application Log Content + - Host Status + - Process Creation +source: WinEventLog:Microsoft-Windows-Windows Defender/Operational +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '1116' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - Action_ID + - Action_Name + - ActivityID + - Additional_Actions_ID + - Additional_Actions_String + - Category_ID + - Category_Name + - Channel + - Computer + - Detection_ID + - Detection_Time + - Detection_User + - dvc + - dvc_nt_host + - Engine_Version + - Error_Code + - Error_Description + - event_id + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Execution_ID + - Execution_Name + - FWLink + - Guid + - id + - Keywords + - Level + - Name + - Opcode + - Origin_ID + - Origin_Name + - Path + - Post_Clean_Status + - Pre_Execution_Status + - Process_Name + - ProcessID + - Product_Name + - Product_Version + - RecordNumber + - Security_intelligence_Version + - severity + - Severity_ID + - severity_id + - Severity_Name + - signature_id + - Source_ID + - Source_Name + - splunk_server + - State + - Status_Code + - System_Props_Xml + - SystemTime + - tag + - Task + - TaskCategory + - ThreadID + - Threat_ID + - Threat_Name + - Type_ID + - Type_Name + - user_id + - UserID + - vendor_product + - Version +example_log: "111603000x80000000000000001799Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0111UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete09Not Applicable0x00000000The operation completed successfully. 00No additional actions requiredAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml new file mode 100644 index 0000000000..4eee9d4d80 --- /dev/null +++ b/data_sources/windows_event_log_defender_1117.yml @@ -0,0 +1,93 @@ +name: Windows Event Log Defender 1117 +id: c620d5f3-53d6-4697-abf5-b2c8434e7ff9 +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-17' +author: Onur Mustafa Erdogan, Splunk +description: Logs an event when a Windows Defender takes an action against detected threat. +mitre_components: + - Application Log Content + - Host Status + - Process Creation +source: WinEventLog:Microsoft-Windows-Windows Defender/Operational +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '1117' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - Action_Name + - ActivityID + - Additional_Actions_ID + - Additional_Actions_String + - Category_ID + - Category_Name + - Channel + - Computer + - Detection_ID + - Detection_Time + - Detection_User + - dvc + - dvc_nt_host + - Engine_Version + - Error_Code + - Error_Description + - event_id + - EventAction_ID + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Execution_ID + - Execution_Name + - FWLink + - Guid + - host + - id + - Keywords + - Level + - Name + - Opcode + - Origin_ID + - Origin_Name + - Path + - Post_Clean_Status + - Pre_Execution_Status + - Process_Name + - ProcessID + - Product_Name + - Product_Version + - RecordNumber + - Remediation_User + - Security_intelligence_Version + - severity + - Severity_ID + - severity_id + - Severity_Name + - signature_id + - source + - Source_ID + - Source_Name + - sourcetype + - splunk_server + - State + - Status_Code + - System_Props_Xml + - SystemTime + - tag + - Task + - TaskCategory + - ThreadID + - Threat_ID + - Threat_Name + - Type_ID + - Type_Name + - user_id + - UserID + - vendor_product + - Version +example_log: "111704000x80000000000000001800Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0321UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete02Quarantine0x00000000The operation completed successfully. 00No additional actions requiredEC2AMAZ-FKEOM7G\\AdministratorAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" diff --git a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml new file mode 100644 index 0000000000..bd2877700b --- /dev/null +++ b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml @@ -0,0 +1,83 @@ +name: Windows Alternate Data Stream Created Over Local Share +id: e974a5c9-cbe9-4b4a-8fba-b55e7dbc8259 +version: 1 +creation_date: '2026-08-19' +modification_date: '2026-08-19' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1). + It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. + Legitimate local processes access files directly rather than through a local SMB share. + This behavior is a hallmark of the ShieldBreak exploit, which abuses a symbolic link swap through a loopback share to redirect a privileged, Defender-driven write into an alternate data stream on a system-owned file, ultimately landing attacker content in C:\Windows\System32. + If confirmed malicious, this activity indicates an in-progress local privilege escalation attempt and should be investigated immediately. +data_source: + - Windows Event Log Security 5145 +search: |- + `wineventlog_security` + EventCode=5145 + IpAddress="127.0.0.1" + ObjectType="File" + | regex RelativeTargetName="(?i)\:\w+$" + | fillnull + | rename IpAddress as dest_ip + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest dest_ip + ShareName ShareLocalPath RelativeTargetName + AccessMask src_user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_alternate_data_stream_created_over_local_share_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with EventCode 5145 enabled. + The Windows TA is also required. + Enable Object Access auditing (success/failure) for File Share in group policy so that RelativeTargetName and IpAddress are populated. +known_false_positives: |- + Backup, replication, or file-sync software may occasionally write alternate data streams over administrative shares. + Loopback (127.0.0.1) access to a local share is rare for legitimate software, tune by ShareName or src_user as needed for your environment. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: An alternate data stream $RelativeTargetName$ was created over a loopback local share on $dest$ +threat_objects: + - field: dest + type: system + - field: RelativeTargetName + type: file_path + - field: src_user + type: user +analytic_story: + - RoguePlanet +asset_type: Endpoint +mitre_attack_id: + - T1564.004 + - T1021.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml index f34db56778..59e7b20e37 100644 --- a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml +++ b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml @@ -1,8 +1,8 @@ name: Windows App Layer Protocol Wermgr Connect To NamedPipe id: 2f3a4092-548b-421c-9caa-84918e1787ef -version: 10 +version: 11 creation_date: '2022-10-28' -modification_date: '2026-05-13' +modification_date: '2026-08-18' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -33,6 +33,8 @@ intermediate_findings: message: wermgr.exe process is creating or connecting to a named pipe $PipeName$ on $dest$ analytic_story: - Qakbot + - RoguePlanet + - Windows Error Reporting Service Elevation of Privilege Vulnerability asset_type: Endpoint mitre_attack_id: - T1071 diff --git a/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml b/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml new file mode 100644 index 0000000000..d4ff791a7e --- /dev/null +++ b/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml @@ -0,0 +1,86 @@ +name: Windows Defender MpClient.dll Loaded by Non-Defender Process +id: 20f72601-2a92-47bc-8776-177671bbe189 +version: 1 +creation_date: '2026-08-19' +modification_date: '2026-08-19' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects mpclient.dll, the Windows Defender client API library, being loaded by a process that is not part of the Windows Defender platform. + mpclient.dll exposes the API surface used to drive on-demand Defender scans (IOAV, MpScan). In the ShieldBreak exploit, the attacker binary loads mpclient.dll directly and calls its scan APIs against an object-manager path in order to trigger a Defender scan against attacker-controlled content as part of a race condition targeting Defender's placeholder-hydration behavior. + If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation. +data_source: + - Sysmon EventID 7 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Processes where + + Processes.loaded_file="mpclient.dll" + NOT Processes.user IN ("* SERVICE", "SYSTEM") + NOT Processes.process_path="*\MpCmdRun.exe" + Processes.process_path IN ( + "*:\\AppData\\Local\\Temp\\*", + "*:\\Perflogs\\*", + "*:\\ProgramData\\*", + "*:\\Temp\\*", + "*:\\Users\\*", + "*:\\Windows\\Tasks\\*" + ) + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.loaded_file Processes.process + Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_mpclient_dll_loaded_by_non_defender_process_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the driver/module loaded from your endpoints. + If you are using Sysmon, configuration must explicitly include image loading events targeting mpclient.dll. +known_false_positives: |- + Third-party security products or custom AV-integration tooling that legitimately calls into the Defender client API may load mpclient.dll outside the Defender platform directories. Filter as necessary for your environment. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The [$loaded_file$] DLL was loaded by a suspicious process [$process_path$] on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - RoguePlanet +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml b/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml new file mode 100644 index 0000000000..023f83d6a9 --- /dev/null +++ b/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml @@ -0,0 +1,76 @@ +name: Windows Defender Threat Detected on Kernel Object Path +id: 702631e8-90ce-43db-90fd-cf0228edc8ad +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-18' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot\). + It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity. + In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32. + If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation. +data_source: + - Windows Event Log Defender 1116 + - Windows Event Log Defender 1117 +search: |- + `ms_defender` + EventCode IN (1116, 1117) + Path="*\\globalroot\\*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + values(EventCode) as EventCode + values(Action_Name) as Action_Name + values(Additional_Actions_String) as Additional_Actions_String + values(FWLink) as FWLink + by dvc Detection_User Path Threat_Name Severity_Name Category_Name + | rename dvc as dest, Detection_User as user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_threat_detected_on_kernel_object_path_filter` +how_to_implement: |- + The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line, via the Splunk Add-on for Microsoft Windows. Ensure the Microsoft-Windows-Windows Defender/Operational channel is being collected so that EventCode 1116 (detection) and 1117 (remediation) events are ingested. +known_false_positives: |- + No false positives have been identified at this time. Legitimate Defender scans do not report detections against paths resolved through the NT object manager namespace. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Windows Defender reported a detection on a kernel object path $Path$ on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: Path + type: file_path +analytic_story: + - RoguePlanet +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1211 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log + source: XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml b/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml new file mode 100644 index 0000000000..23ce74f162 --- /dev/null +++ b/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml @@ -0,0 +1,84 @@ +name: Windows Error Report Created in ReportQueue Manually +id: c3b33d42-dd28-41bc-8abd-407654a5c9bc +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-18' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries. + Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash. + In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity. + If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting. +data_source: + - Sysmon EventID 11 +search: |- + `sysmon` + EventCode=11 + action IN ("created","modified") + file_name="*.wer" + file_path="*\\ReportQueue\\*" + NOT process_path IN ( + "*\\svchost.exe", + "*\\werfault.exe", + "*\\werfaultsecure.exe", + "*\\wermgr.exe" + ) + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest file_name file_path file_hash action + process_name process_path process_id user vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_error_report_created_in_reportqueue_manually_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with file creation events from your endpoints. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .wer or containing ReportQueue, since these are commonly excluded by default configurations. +known_false_positives: |- + Crash-reporting or telemetry agents that integrate with Windows Error Reporting may stage .wer files outside the standard WER binaries. Tune by Image as necessary for your environment. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://isc.sans.edu/diary/22536 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 40 + message: A suspicious process [$process_name$] created a Windows Error Reporting report [$file_path$] on [$dest$] +threat_objects: + - field: process_name + type: process_name + - field: file_path + type: file_path +analytic_story: + - RoguePlanet + - Windows Privilege Escalation + - Windows Error Reporting Service Elevation of Privilege Vulnerability +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1053.005 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/wer_file_creation.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_phantom_dll_created_on_disk.yml b/detections/endpoint/windows_phantom_dll_created_on_disk.yml new file mode 100644 index 0000000000..d953b9f1e6 --- /dev/null +++ b/detections/endpoint/windows_phantom_dll_created_on_disk.yml @@ -0,0 +1,111 @@ +name: Windows Phantom DLL Created on Disk +id: 34cb2dfb-1dec-4b6b-bc72-c3904e5e4521 +version: 2 +creation_date: '2026-08-17' +modification_date: '2026-08-20' +author: Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects creation of DLL files with names associated with phantom DLL hijacking opportunities. + These DLLs are usually absent from standard Windows installations, but legitimate Windows components or services may attempt to load them when they are present in expected search paths such as System32. + Phantom DLL hijacking involves placing a malicious DLL where a legitimate process will search for a non-existent dependency, allowing the attacker-controlled library to execute in that process context. + ShieldBreak is one example where the exploit redirects a privileged Defender-driven write into C:\Windows\System32\phoneinfo.dll and then triggers Windows Error Reporting so wermgr.exe loads the planted DLL at SYSTEM integrity. + If confirmed malicious, this activity can indicate preparation for code execution, persistence, or local privilege escalation through DLL search order hijacking. +data_source: + - Sysmon EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created","modified") + + Filesystem.file_path IN ( + "*:\\Windows\\System32\\axeonoffhelper.dll", + "*:\\Windows\\System32\\cdpsgshims.dll", + "*:\\Windows\\System32\\oci.dll", + "*:\\Windows\\System32\\offdmpsvc.dll", + "*:\\Windows\\System32\\shellchromeapi.dll", + "*:\\Windows\\System32\\TSMSISrv.dll", + "*:\\Windows\\System32\\TSVIPSrv.dll", + "*:\\Windows\\System32\\wbem\\wbemcomn.dll", + "*:\\Windows\\System32\\WLBSCTRL.dll", + "*:\\Windows\\System32\\wow64log.dll", + "*:\\Windows\\System32\\WptsExtensions.dll", + "*\\phoneinfo.dll", + "*\\SprintCSP.dll" + ) + by Filesystem.action Filesystem.dest Filesystem.file_hash + Filesystem.file_name Filesystem.file_path Filesystem.process_id + Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_phantom_dll_created_on_disk_filter` +how_to_implement: |- + To successfully implement this search, you need file creation telemetry from Windows endpoints mapped into the Endpoint.Filesystem datamodel. + If you are using Sysmon, enable EventID 11 and ensure the FileCreate configuration captures the full target filename for DLL creations in Windows system paths. +known_false_positives: |- + Some legacy or third-party components may create DLLs with these names for legitimate compatibility reasons, but creation in Windows system paths should be uncommon. + Review the creating process, signer, file hash, path, and whether the DLL is expected on the host before tuning. +references: + - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html + - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/ + - https://decoded.avast.io/martinchlumecky/png-steganography/ + - https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc + - https://github.com/Wh04m1001/SysmonEoP + - https://itm4n.github.io/cdpsvc-dll-hijacking/ + - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992 + - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ + - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ + - https://www.hexacorn.com/blog/2016/06/02/beyond-good-ol-run-key-part-40/ + - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ + - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/ + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://x.com/0gtweet/status/1564131230941122561 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: A phantom DLL candidate named [$file_name$] was created at [$file_path$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path +analytic_story: + - RoguePlanet + - Windows Privilege Escalation + - Windows Defense Evasion Tactics +asset_type: Endpoint +mitre_attack_id: + - T1574.001 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_process_injection_wermgr_child_process.yml b/detections/endpoint/windows_process_injection_wermgr_child_process.yml index 66f47b2066..14dce5c439 100644 --- a/detections/endpoint/windows_process_injection_wermgr_child_process.yml +++ b/detections/endpoint/windows_process_injection_wermgr_child_process.yml @@ -1,8 +1,8 @@ name: Windows Process Injection Wermgr Child Process id: 360ae6b0-38b5-4328-9e2b-bc9436cddb17 -version: 11 +version: 12 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-08-18' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ intermediate_findings: analytic_story: - Qakbot - Windows Error Reporting Service Elevation of Privilege Vulnerability + - RoguePlanet asset_type: Endpoint mitre_attack_id: - T1055 diff --git a/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml b/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml new file mode 100644 index 0000000000..61822ae203 --- /dev/null +++ b/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml @@ -0,0 +1,90 @@ +name: Windows Wermgr Spawning System Integrity Process +id: d39634c8-7ce7-4503-a5da-73ca3c758fb9 +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-18' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level. + WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children. + In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell. + If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_name="WerMgr.exe" + ( + Processes.process_integrity_level="System" + OR + Processes.user IN ("*$", "System") + ) + + by Processes.action Processes.dest Processes.parent_process_name Processes.parent_process_path + Processes.parent_process Processes.parent_process_id Processes.process_name + Processes.process_path Processes.process Processes.process_id Processes.process_hash + Processes.process_integrity_level Processes.user Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_wermgr_spawning_system_integrity_process_filter` +how_to_implement: |- + This detection is based on Process creation events. Make sure you are ingesting logs that contain parent process details and fields that indicate privilege level, such as user name or integrity level. If you are using Sysmon, make sure to enable logging of child processes of WerMgr.exe. +known_false_positives: |- + No false positives have been identified at this time. + WerMgr.exe spawning a SYSTEM-integrity child process is not expected under normal Windows Error Reporting operation. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://isc.sans.edu/diary/22536 +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The [$parent_process_name$] process spawned [$process_name$] running at SYSTEM integrity level on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: process_name + type: process_name +analytic_story: + - RoguePlanet + - Windows Privilege Escalation + - Windows Error Reporting Service Elevation of Privilege Vulnerability +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1134.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/system_integrity_process.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/stories/rogueplanet.yml b/stories/rogueplanet.yml index 5ad81b0574..d050586cbc 100644 --- a/stories/rogueplanet.yml +++ b/stories/rogueplanet.yml @@ -1,9 +1,9 @@ name: RoguePlanet id: eafb5ab2-71bb-4da9-a541-015d002f01f1 -version: 1 +version: 2 creation_date: '2026-06-11' -modification_date: '2026-06-11' -author: Teoderick Contreras, Splunk +modification_date: '2026-08-17' +author: Teoderick Contreras, Onur Mustafa Erdogan, Splunk status: production description: |- RoguePlanet is a publicly released proof-of-concept exploit targeting a race condition in Microsoft Windows Defender. The attack abuses Defender scanning behavior, NTFS alternate data streams, virtual ISO mounting, volume shadow copy paths, and opportunistic oplocks to achieve local privilege escalation to SYSTEM. @@ -17,13 +17,22 @@ narrative: | From a detection standpoint, the most durable observables are Sysmon Event ID 15 records showing :WDFOO alternate data streams on wermgr.exe under RP_* temp directories, MsMpEng.exe touching those same paths, and the initial RoguePlanet.exe process writing ADS content. Secondary signals include creation of RP_* directories, virtual disk attach activity, reparse-point manipulation, and a user-context process later spawning SYSTEM-integrity children. - This analytic story groups detections that surface alternate data stream abuse, suspicious Defender-adjacent file activity, and privilege escalation patterns consistent with RoguePlanet and similar Windows Defender bypass research. Security teams should treat any matching activity as high priority, validate patch and Defender configuration status, and isolate affected endpoints pending vendor guidance. + ShieldBreak is a related proof-of-concept published by NightmareEclipse that exploits the same underlying weakness in Defender's scanning pipeline, targeting Windows Server 2025 rather than client builds. A low-privileged executable creates a working directory under C:\ShieldBreak_{GUID}\, registers a fake cloud storage provider, and creates a cloud file placeholder named BERLIN with a stream ADS. It loads mpclient.dll, Defender's own client API library, and directs Defender to scan a path resolved through the object manager under \BaseNamedObjects\Restricted\, hydrating the placeholder on demand. + + ShieldBreak wins its race through symbolic link manipulation rather than oplocks: an object-manager symlink initially resolves the scan target to the working directory, then is swapped to resolve through a CLFS path so that a locked Defender artifact file (BERLIN.blf) is produced instead. A second symbolic link, created over a local administrative share targeting 127.0.0.1, redirects that locked file to \Windows\System32\phoneinfo.dll, so the subsequent hydration writes the attacker's payload directly into a privileged system directory. The exploit then fabricates a Windows Error Report under the WER ReportQueue directory and manually executes the QueueReporting scheduled task, causing wermgr.exe to load phoneinfo.dll -- a classic phantom-DLL hijack target -- which steals a SYSTEM token and spawns an elevated shell. + + This analytic story groups detections that surface alternate data stream abuse, suspicious Defender-adjacent file and module-load activity, Windows Error Reporting abuse, and privilege escalation patterns consistent with RoguePlanet, ShieldBreak, and similar Windows Defender bypass research. Security teams should treat any matching activity as high priority, validate patch and Defender configuration status, and isolate affected endpoints pending vendor guidance. references: - https://github.com/MSNightmare/RoguePlanet/tree/main - https://attack.mitre.org/techniques/T1068/ - https://attack.mitre.org/techniques/T1564/004/ - https://attack.mitre.org/techniques/T1211/ - https://car.mitre.org/analytics/CAR-2020-08-001/ + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.picussecurity.com/resource/blog/rogueplanet-anatomy-of-the-nightmare-eclipse-microsoft-defender-zero-day#from-rce-to-lpe:-the-smb-and-vhdx-origin-story + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://www.hexacorn.com/blog/2016/06/02/beyond-good-ol-run-key-part-40/ + - https://secret.club/2020/07/01/diagtrack.html category: - Adversary Tactics product: From b21862c1c7821eb6194ecf391cd3363b9b8f8e59 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Fri, 21 Aug 2026 12:21:24 +0200 Subject: [PATCH 078/164] Add New Detections Against Malicious Python Package Activities (#4205) --------- Co-authored-by: Nasreddine Bencherchali --- ...n_network_traffic_during_package_build.yml | 112 ++++++++++++++++++ ...e_creation_during_package_installation.yml | 106 +++++++++++++++++ ...dification_during_package_installation.yml | 106 +++++++++++++++++ ...s_creation_during_package_installation.yml | 107 +++++++++++++++++ .../malicious_python_package_installation.yml | 28 +++++ 5 files changed, 459 insertions(+) create mode 100644 detections/endpoint/python_network_traffic_during_package_build.yml create mode 100644 detections/endpoint/python_pth_file_creation_during_package_installation.yml create mode 100644 detections/endpoint/python_pythonpath_modification_during_package_installation.yml create mode 100644 detections/endpoint/python_site_hooks_creation_during_package_installation.yml create mode 100644 stories/malicious_python_package_installation.yml diff --git a/detections/endpoint/python_network_traffic_during_package_build.yml b/detections/endpoint/python_network_traffic_during_package_build.yml new file mode 100644 index 0000000000..eeb6f097b7 --- /dev/null +++ b/detections/endpoint/python_network_traffic_during_package_build.yml @@ -0,0 +1,112 @@ +name: Python Network Traffic During Package Build +id: 03c9c504-2294-44da-8180-beefe1ca8ba8 +version: 1 +creation_date: '2026-08-21' +modification_date: '2026-08-21' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects a Python process making an outbound network connection during package installation. + Adversaries can abuse `setup.py` build scripts by leveraging `distutils`/`setuptools` command classes to execute arbitrary code, including network beacons to third-party domains, the moment a malicious Python package is installed. + This activity is significant because it allows adversaries to establish a foothold or exfiltrate data without any direct interaction from the victim beyond running `pip install`. + If confirmed malicious, this could indicate a successful software supply chain compromise. +data_source: + - Sysmon EventID 1 AND Sysmon EventID 3 +search: |- + `sysmon` + ( + EventID=1 + ( + process="*_in_process.py*" + OR + process_name=python.exe + ) + ) + OR + ( + EventID=3 + dest_ip!="" + process_name=python.exe + ) + + | eval dest=if(EventID=3, Computer, dest) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_id) as parent_process_id + values(parent_process_path) as parent_process_path + values(parent_process_name) as parent_process_name + values(parent_process) as parent_process + values(process_path) as process_path + values(process_name) as process_name + values(process) as process + values(dest_ip) as dest_ip + values(dest_host) as dest_host + + by dest source process_id + + | search process="* build_wheel*" + + | table firstTime lastTime + parent_process_id parent_process_path parent_process_name parent_process + process_id process_path process_name process + dest_ip dest_host + dest source + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `python_network_traffic_during_package_build_filter` +how_to_implement: |- + The detection is based on data that originates from Sysmon. To implement this search, you must ingest logs + with process creation (EventID 1) and network connection (EventID 3) events, mapped via the appropriate + Splunk Technology Add-on. Use the Splunk Common Information Model (CIM) to normalize the field names. +known_false_positives: |- + Python packages may contact software repositories, mirror sites during build time. + Investigate the destination and package content to determine legitimacy. +references: + - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A Python process [$process$] on [$dest$] made an outbound network connection to [$dest_ip$] with hostname [$dest_host$] during package installation. +threat_objects: + - field: process + type: process + - field: dest_ip + type: ip_address + - field: dest_host + type: domain +analytic_story: + - Malicious Python Package Installation + - Ingress Tool Transfer + - Command And Control + - Compromised Windows Host +asset_type: Endpoint +mitre_attack_id: + - T1195.002 + - T1059.006 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/python_pth_file_creation_during_package_installation.yml b/detections/endpoint/python_pth_file_creation_during_package_installation.yml new file mode 100644 index 0000000000..c7c514aee1 --- /dev/null +++ b/detections/endpoint/python_pth_file_creation_during_package_installation.yml @@ -0,0 +1,106 @@ +name: Python PTH File Creation During Package Installation +id: bf581b86-39cd-48b7-9312-d9affb48a8bc +version: 1 +creation_date: '2026-08-21' +modification_date: '2026-08-21' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process. + Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type. + This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package. + If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host. +data_source: + - Sysmon EventID 1 AND Sysmon EventID 11 +search: |- + `sysmon` + EventID IN (1,11) + process_name="python.exe" + ( + process="* install *" + OR + ( + file_name="*.pth" + action="created" + ) + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_id) as parent_process_id + values(parent_process_path) as parent_process_path + values(parent_process_name) as parent_process_name + values(parent_process) as parent_process + values(process_path) as process_path + values(process_name) as process_name + values(process) as process + values(file_name) as file_name + values(file_path) as file_path + dc(EventID) as dc_event_id + + by dest source process_id + + | search dc_event_id>1 AND process!="*-- setuptools*" + + | table firstTime lastTime + parent_process_id parent_process_path parent_process_name parent_process + process_id process_path process_name process + file_name file_path + dest source + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `python_pth_file_creation_during_package_installation_filter` +how_to_implement: |- + This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1) + and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .pth + extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the + Splunk Common Information Model (CIM). +known_false_positives: |- + Legitimate packages, such as those managing namespace packages or editable installs, may create `.pth` files as part of normal installation. + Investigate the file contents and parent process to determine legitimacy. +references: + - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 30 + message: A Python .pth file called [$file_name$] located at [$file_path$] was created on [$dest$] during package installation using [$process$]. +threat_objects: + - field: process + type: process + - field: file_name + type: file_name + - field: file_path + type: file_path +analytic_story: + - Malicious Python Package Installation + - Compromised Windows Host + - Windows Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1546 + - T1195.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/python_pythonpath_modification_during_package_installation.yml b/detections/endpoint/python_pythonpath_modification_during_package_installation.yml new file mode 100644 index 0000000000..a314b6e63e --- /dev/null +++ b/detections/endpoint/python_pythonpath_modification_during_package_installation.yml @@ -0,0 +1,106 @@ +name: Python PYTHONPATH Modification During Package Installation +id: 00f01ba4-df01-4caa-90f6-187e4563a516 +version: 1 +creation_date: '2026-08-21' +modification_date: '2026-08-21' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process. + Python looks up the `sys.path` variable, which is generated by combining user and site folders with `.pth` files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules. + If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions. + If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user. +data_source: + - Sysmon EventID 1 AND Sysmon EventID 13 +search: |- + `sysmon` + EventID IN (1,13) + ( + parent_process="*\\site-packages\\pip\\*" + OR + ( + registry_path="*PYTHONPATH" + action="modified" + ) + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_id) as parent_process_id + values(parent_process_name) as parent_process_name + values(parent_process_path) as parent_process_path + values(parent_process) as parent_process + values(process_path) as process_path + values(process_name) as process_name + values(process) as process + values(registry_path) as registry_path + values(registry_value_data) as registry_value_data + dc(EventID) as dc_event_id + + by dest source process_id + + | search dc_event_id>1 + + | table firstTime lastTime + parent_process_id parent_process_path parent_process_name parent_process + process_id process_path process_name process + registry_path registry_value_data + dest source + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `python_pythonpath_modification_during_package_installation_filter` +how_to_implement: |- + This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1) + and registry modification (EventID 13) events, ensuring that registry modification events are collected for the + PYTHONPATH environment variable(\Environment\PYTHONPATH). Ingest the data via the appropriate Splunk Technology Add-on + and normalize field names using the Splunk Common Information Model (CIM). +known_false_positives: |- + Developers and legitimate installers may modify PYTHONPATH as part of normal environment configuration. + Investigate the new value and parent process to determine legitimacy. +references: + - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The PYTHONPATH environment variable [$registry_path$] was modified to the value of [$registry_value_data$] on [$dest$] during package installation using [$process$]. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: registry_value_data + type: registry_value_data +analytic_story: + - Malicious Python Package Installation + - Compromised Windows Host + - Windows Persistence Techniques + - Suspicious Windows Registry Activities + - Windows Registry Abuse +asset_type: Endpoint +mitre_attack_id: + - T1574.007 + - T1195.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/python_site_hooks_creation_during_package_installation.yml b/detections/endpoint/python_site_hooks_creation_during_package_installation.yml new file mode 100644 index 0000000000..43b5a52eaf --- /dev/null +++ b/detections/endpoint/python_site_hooks_creation_during_package_installation.yml @@ -0,0 +1,107 @@ +name: Python Site Hooks Creation During Package Installation +id: efaf40f5-779f-4b48-a941-b7d1a7c931ed +version: 1 +creation_date: '2026-08-21' +modification_date: '2026-08-21' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process. + Python's `site` module loads these hooks from directories on `sys.path` before Python is executed. + If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint. + The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution. + If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host. +data_source: + - Sysmon EventID 1 AND Sysmon EventID 11 +search: |- + `sysmon` + EventID IN (1,11) + ( + process="* install *" + OR + ( + action="created" + file_path="*-packages\\*" + file_path IN ("*sitecustomize.py", "*usercustomize.py") + ) + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_id) as parent_process_id + values(parent_process_path) as parent_process_path + values(parent_process_name) as parent_process_name + values(parent_process) as parent_process + values(process_path) as process_path + values(process_name) as process_name + values(process) as process + values(file_path) as file_path + values(file_name) as file_name + dc(EventID) as dc_event_id + by dest source process_id + + | search dc_event_id>1 + + | table firstTime lastTime + parent_process_id parent_process_path parent_process_name parent_process + process_id process_path process_name process + file_path file_name + dest source + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `python_site_hooks_creation_during_package_installation_filter` +how_to_implement: |- + This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1) + and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .py + extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the + Splunk Common Information Model (CIM). +known_false_positives: |- + Some legitimate tooling and environment managers create or modify `sitecustomize.py`/`usercustomize.py` + as part of normal setup. Investigate the file contents and parent process to determine legitimacy. +references: + - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: A Python site hook file [$file_path$] was created on [$dest$] during package installation using [$process$]. + entity: + field: dest + type: system + score: 40 +threat_objects: + - field: process + type: process + - field: file_path + type: file_path + - field: file_name + type: file_name +analytic_story: + - Malicious Python Package Installation + - Compromised Windows Host + - Windows Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1546 + - T1195.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/stories/malicious_python_package_installation.yml b/stories/malicious_python_package_installation.yml new file mode 100644 index 0000000000..d7d6635781 --- /dev/null +++ b/stories/malicious_python_package_installation.yml @@ -0,0 +1,28 @@ +name: Malicious Python Package Installation +id: 12e51c50-6b66-4ce7-83b8-95125ffd31e9 +version: 1 +creation_date: '2026-08-21' +modification_date: '2026-08-21' +author: Onur Mustafa Erdogan, Splunk +status: production +description: |- + This analytic story provides detection coverage for abuse of the Python package installation lifecycle, including install-time code execution, persistence via `.pth` path configuration files, Python site hooks, and PYTHONPATH environment variable manipulation. +narrative: |- + Python's popularity, readable syntax, and extensive third-party library ecosystem make it an attractive target for threat actors seeking to compromise developer devices and infrastructure. + Malicious packages and supply-chain attacks exploit the trust built into Python's packaging ecosystem to execute payloads at the moment of installation, without any direct interaction from the victim. Adversaries abuse several native Python features to achieve this. + `setup.py` build scripts can leverage `distutils`/`setuptools` command classes to execute arbitrary code, including + network beacons, during package installation. + Path configuration files (`.pth`) placed in `site-packages`/`dist-packages` are executed on every subsequent Python invocation, providing persistence; this technique was used by the threat actor group TeamPCP during the supply-chain compromise of the `litellm` package. Python's `site` module also loads `sitecustomize.py` and `usercustomize.py` hook files from directories on `sys.path`, which adversaries can plant or manipulate to hijack the Python environment and achieve persistence, as seen with the VIPERTUNNEL backdoor. + Finally, adversaries who can modify a user's `PYTHONPATH` environment variable can redirect module imports to attacker-controlled directories,achieving user-level persistence across new shell sessions. + This story detects these behaviors by correlating process creation, file creation, and registry modification telemetry around Python package installation activity. +references: + - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ +category: + - Adversary Tactics +usecase: Advanced Threat Detection +threat_group: + - TeamPCP +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud From 981dfb2a047c4ed6c4de61f38184e998be34df8c Mon Sep 17 00:00:00 2001 From: fe-brain Date: Mon, 24 Aug 2026 19:16:08 +0700 Subject: [PATCH 079/164] Update known_false_positives for Excessive Usage of NSLOOKUP App (#4231) --------- Co-authored-by: Nasreddine Bencherchali --- detections/endpoint/excessive_usage_of_nslookup_app.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 5b7e8644f4..413f138d49 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -1,8 +1,8 @@ name: Excessive Usage of NSLOOKUP App id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 -version: 12 +version: 13 creation_date: '2021-04-22' -modification_date: '2026-05-13' +modification_date: '2026-08-24' author: Teoderick Contreras, Stanislav Miskovic, Splunk status: production type: Anomaly @@ -25,7 +25,7 @@ search: |- | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used. -known_false_positives: No false positives have been identified at this time. +known_false_positives: Network or DNS monitoring tools that perform bulk nslookup checks against multiple domains in quick succession (e.g., CDN health checks, load balancer DNS validation scripts) may exceed the detection threshold as part of normal, scheduled operation. Hosts with limited historical baseline data may also cross the dynamic threshold more easily due to low computed average and standard deviation values. Tune the detection or add exceptions for known monitoring tool parent processes as needed. references: - https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings - https://www.varonis.com/blog/dns-tunneling From 9a2c4a5df40cdfe3d4e11481110a8140fea776b1 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 24 Aug 2026 14:17:45 +0200 Subject: [PATCH 080/164] bump to contentctl-ng 1.1.1 in requirements (#4232) Co-authored-by: Nasreddine Bencherchali --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 628e150e83..4bbb0e2cf0 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -contentctl-ng==1.0.2 +contentctl-ng==1.1.1 From c574888a5db1d41ac2b384d00f7b3ea76c1663e1 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 24 Aug 2026 14:47:41 +0200 Subject: [PATCH 081/164] Fix Issues & Deprecate Some Experimental Content (#4212) --- .../windows_event_log_security_5441.yml | 25 +++ .../windows_event_log_security_5447.yml | 101 ++++++++++++ .../esxi_encryption_settings_modified.yml | 29 +++- .../detect_f5_tmui_rce_cve_2020_5902.yml | 10 +- ..._append_command_to_profile_config_file.yml | 64 ++++++-- .../endpoint/ping_sleep_batch_command.yml | 50 ++++-- ...rsilencer_custom_outbound_filter_added.yml | 98 +++++++++++ ...form_filter_added_to_block_edr_process.yml | 153 ++++++++++++++++++ ...t_password_policy_to_unlimited_via_net.yml | 54 ++++--- 9 files changed, 526 insertions(+), 58 deletions(-) create mode 100644 data_sources/windows_event_log_security_5441.yml create mode 100644 data_sources/windows_event_log_security_5447.yml rename detections/{web => deprecated}/detect_f5_tmui_rce_cve_2020_5902.yml (84%) create mode 100644 detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml create mode 100644 detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml diff --git a/data_sources/windows_event_log_security_5441.yml b/data_sources/windows_event_log_security_5441.yml new file mode 100644 index 0000000000..e8a62868bd --- /dev/null +++ b/data_sources/windows_event_log_security_5441.yml @@ -0,0 +1,25 @@ +name: Windows Event Log Security 5441 +id: aac843ab-4cd6-4735-9557-cde0b504c9c9 +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +description: Logs Windows Filtering Platform filters that were present when the Base Filtering Engine started, including provider, filter, layer, conditions, and filter action metadata. +mitre_components: + - Firewall Metadata + - Security Policy Modification + - Application Log Content +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '5441' +configuration: Enable the Audit Filtering Platform Policy Change subcategory to collect Windows Filtering Platform policy events. +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time +output_fields: + - dest +example_log: '' diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml new file mode 100644 index 0000000000..94e8f2a90c --- /dev/null +++ b/data_sources/windows_event_log_security_5447.yml @@ -0,0 +1,101 @@ +name: Windows Event Log Security 5447 +id: b94e3b5d-d00f-4fed-88e9-c8ea87495618 +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +description: Logs Windows Filtering Platform runtime filter changes, including the change type, provider, filter, layer, conditions, and filter action metadata. +mitre_components: + - Firewall Rule Modification + - Security Policy Modification + - Application Log Content +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '5447' +configuration: Enable the Audit Filtering Platform Policy Change subcategory to collect Windows Filtering Platform policy events. +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - Action + - ActivityID + - CalloutKey + - CalloutName + - ChangeType + - Channel + - Computer + - Conditions + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - FilterId + - FilterKey + - FilterName + - FilterType + - Guid + - Keywords + - LayerId + - LayerKey + - LayerName + - Level + - Name + - Opcode + - ProcessID + - ProcessId + - ProviderKey + - ProviderName + - RecordNumber + - SystemTime + - System_Props_Xml + - Task + - ThreadID + - UserName + - UserSid + - Version + - Weight + - action + - app + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - dvc_nt_host + - event_id + - eventtype + - host + - id + - index + - linecount + - name + - product + - punct + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - subject + - ta_windows_action + - tag + - tag::action + - tag::eventtype + - timeendpos + - timestartpos + - user + - vendor + - vendor_product +output_fields: + - dest +example_log: | + 5447001357300x8020000000000000153502136Securityar-win-dc.attackrange.local16824S-1-5-21-3344543075-1022232225-2459664213-500ATTACKRANGE\Administrator{a4b43ab7-75d5-4d88-a62c-8b5d2677c73d}Microsoft Corporation%%16384{da607736-f157-4bdd-9ad9-042516072b55}Custom Outbound Filter%%16387305460{c38d57d1-05a7-4c33-904f-7fbceee60e82}ALE Connect v4 Layer4818446744073709551615Condition ID: {d78e1e87-8644-4ea5-9437-d809ecefc971} Match value: Equal to Condition value: 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \.d.e.v.i.c.e.\. 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k. 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 33 00 5c 00 v.o.l.u.m.e.3.\. 00000030 70 00 72 00 6f 00 67 00-72 00 61 00 6d 00 64 00 p.r.o.g.r.a.m.d. 00000040 61 00 74 00 61 00 5c 00-6d 00 69 00 63 00 72 00 a.t.a.\.m.i.c.r. 00000050 6f 00 73 00 6f 00 66 00-74 00 5c 00 77 00 69 00 o.s.o.f.t.\.w.i. 00000060 6e 00 64 00 6f 00 77 00-73 00 20 00 64 00 65 00 n.d.o.w.s. .d.e. 00000070 66 00 65 00 6e 00 64 00-65 00 72 00 5c 00 70 00 f.e.n.d.e.r.\.p. 00000080 6c 00 61 00 74 00 66 00-6f 00 72 00 6d 00 5c 00 l.a.t.f.o.r.m.\. 00000090 34 00 2e 00 31 00 38 00-2e 00 32 00 36 00 30 00 4...1.8...2.6.0. 000000a0 34 00 30 00 2e 00 37 00-2d 00 30 00 5c 00 6d 00 4.0...7.-.0.\.m. 000000b0 73 00 6d 00 70 00 65 00-6e 00 67 00 2e 00 65 00 s.m.p.e.n.g...e. 000000c0 78 00 65 00 00 00 x.e...%%16389{00000000-0000-0000-0000-000000000000}- diff --git a/detections/application/esxi_encryption_settings_modified.yml b/detections/application/esxi_encryption_settings_modified.yml index fa76c3090d..8742e7446f 100644 --- a/detections/application/esxi_encryption_settings_modified.yml +++ b/detections/application/esxi_encryption_settings_modified.yml @@ -1,17 +1,34 @@ name: ESXi Encryption Settings Modified id: dbbbe26f-83fe-4ee3-8b77-ccf7fbd416c8 -version: 5 +version: 6 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-08-12' author: Raven Tait, Splunk status: production type: TTP description: Detects the disabling of critical encryption enforcement settings on an ESXi host, such as secure boot or executable verification requirements, which may indicate an attempt to weaken hypervisor integrity or allow unauthorized code execution. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` Message="*system settings encryption set*" NOT Message="*shell.*" Message IN ("* -s *", "* -e *","*--require-secure-boot*", "*require-exec-installed-only*", "execInstalledOnly") | rex field=_raw "Z (?[\w\.]*)\s.*\]: \[(?\w+)\]:(?.+)" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_encryption_settings_modified_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message = "*system settings encryption set*" + NOT Message = "*shell.*" + Message IN ( + "* -e *", + "* -s *", + "*--require-secure-boot*", + "*execInstalledOnly*", + "*require-exec-installed-only*" + ) + | rex field=_raw "Z (?[\w\.]*)\s.*\]: \[(?\w+)\]:(?.+)" + | stats min(_time) as firstTime max(_time) as lastTime count by dest user command + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_encryption_settings_modified_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: |- + Limited false positives in most environments, however tune as needed. drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -22,7 +39,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Encryption settings modified on ESXi host $dest$. + title: Encryption settings modified on ESXi host [$dest$]. entity: field: dest type: system diff --git a/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml b/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml similarity index 84% rename from detections/web/detect_f5_tmui_rce_cve_2020_5902.yml rename to detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml index 888745f082..f1845674e2 100644 --- a/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml +++ b/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml @@ -1,10 +1,10 @@ name: Detect F5 TMUI RCE CVE-2020-5902 id: 810e4dbc-d46e-11ea-87d0-0242ac130003 -version: 9 +version: 10 creation_date: '2020-08-04' -modification_date: '2026-05-13' +modification_date: '2026-08-10' author: Shannon Davis, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902. It uses regex to detect patterns in syslog data that match known exploit strings such as "hsqldb;" and directory traversal sequences. This activity is significant because successful exploitation can allow attackers to execute arbitrary commands on the affected devices, leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, or further lateral movement within the network. data_source: [] @@ -33,3 +33,7 @@ product: - Splunk Cloud category: web security_domain: network +deprecation_info: + reason: Detection deprecated as it is targeting a 6 years old CVE that is no longer relevant, since the OS version targeted is no longer supported by F5. As well, the fact that the detection has been set to experimental since 2020. + removed_in_version: 6.6.0 + replacement_content: [] diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index 9ebd9e7597..c6ae384782 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -1,26 +1,57 @@ name: Linux Possible Append Command To Profile Config File id: 9c94732a-61af-11ec-91e3-acde48001122 -version: 11 +version: 12 creation_date: '2022-01-11' -modification_date: '2026-05-13' +modification_date: '2026-08-12' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile. This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts. If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation. +description: |- + The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile. + This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts. + If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation. data_source: - Sysmon for Linux EventID 1 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process = "*echo*" - AND - Processes.process IN("*~/.bashrc", "*~/.bash_profile", "*/etc/profile", "~/.bash_login", "*~/.profile", "~/.bash_logout") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process = "*echo*" + ( + Processes.process IN ("*/home/*", "*~/*") + Processes.process IN ( + "*/.bash_login*", + "*/.bash_logout*", + "*/.bash_profile*", + "*/.bashrc*", + "*/.profile*", + "*/etc/profile*" + ) + OR + ( + Processes.process_current_directory = "/home/*" + Processes.process IN ( + "*.bash_login*", + "*.bash_logout*", + "*.bash_profile*", + "*.bashrc*", + "*.profile*", + "* profile*" + ) + ) + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + process_current_directory Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -44,7 +75,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: a commandline $process$ that may modify profile files on $dest$ + message: The [$process_name$] process is attempting to modify Shell Profile files via the Command Line [$process$] on [$dest$] +threat_objects: + - field: process + type: process analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index 37c510fdca..b34b2835a4 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -1,16 +1,17 @@ name: Ping Sleep Batch Command id: ce058d6c-79f2-11ec-b476-acde48001122 -version: 16 +version: 17 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-08-11' author: Teoderick Contreras, Splunk status: production type: Anomaly description: |- - The following analytic identifies the execution of ping sleep batch commands. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process command-line details. - This activity is significant as it indicates an attempt to delay malicious code execution, potentially evading detection or sandbox analysis. - If confirmed malicious, this technique allows attackers to bypass security measures, making it harder to detect and analyze their activities, thereby increasing the risk of prolonged unauthorized access and potential data exfiltration. + The following analytic identifies the use of ping commands as a delay or sleep mechanism within batch-style command execution. + It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and examines process and parent process command-line fields for ping commands that specify a count and are chained with additional commands using command separators or redirection operators. + While execution of the command may generate individual process creation events, such as a separate ping.exe process, this analytic specifically focuses on the original command string passed to a command interpreter, such as cmd.exe /c, that combines the ping-based delay with subsequent command execution. + Adversaries may use ping as an alternative to explicit sleep or timeout commands to introduce execution delays, potentially evading automated analysis, sandboxing, or behavior-based detection. + Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay. data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 @@ -22,13 +23,17 @@ search: |- FROM datamodel=Endpoint.Processes WHERE ( Processes.parent_process= "*ping*" - Processes.parent_process = *-n* + Processes.parent_process IN ( + "*-n*", + "*/n*" + ) Processes.parent_process IN ( "*& *", "*&*", "*&C:*", "*>*", - "*>*" + "*>*", + "*||*" ) ) OR @@ -38,13 +43,17 @@ search: |- OR Processes.original_file_name= "ping.exe" ) - Processes.process = *-n* + Processes.process IN ( + "*-n*", + "*/n*" + ) Processes.process IN ( "*& *", "*&*", "*&C:*", "*>*", - "*>*" + "*>*", + "*||*" ) ) @@ -61,8 +70,16 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ping_sleep_batch_command_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrator or network operator may execute this command. Please update the filter macros to remove false positives. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrators, network operators, scripts, and software installers may legitimately use ping commands as a simple delay mechanism between commands or operations. + Review the full command line, parent process, user context, and surrounding activity to determine whether the execution is expected. + Update the filter macro to exclude known legitimate command patterns or processes in your environment. references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ drilldown_searches: @@ -79,11 +96,16 @@ intermediate_findings: - field: user type: user score: 20 - message: suspicious $process$ commandline run on $dest$ + message: Potential ping-based execution delay detected on [$dest$] by [$user$] via [$process$] - field: dest type: system score: 20 - message: suspicious $process$ commandline run on $dest$ + message: Potential ping-based execution delay detected on [$dest$] by [$user$] via [$process$] +threat_objects: + - field: process + type: process + - field: parent_process + type: parent_process analytic_story: - Warzone RAT - Quasar RAT diff --git a/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml b/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml new file mode 100644 index 0000000000..0a1f79aff1 --- /dev/null +++ b/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml @@ -0,0 +1,98 @@ +name: Windows EDRSilencer Custom Outbound Filter Added +id: 67fea630-445d-4c70-a7d0-584fddb93b86 +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects the EDRSilencer-specific Windows Filtering Platform filter name "Custom Outbound Filter" when it is configured with a block action. + EDRSilencer creates WFP filters to block outbound traffic from EDR and security agent processes, impairing endpoint telemetry without requiring the tool binary to keep its original process name. + EventCode 5447 identifies creation of the runtime filter with ChangeType %%16384, while EventCode 5441 can show the same persistent filter when the Base Filtering Engine starts. +data_source: + - Windows Event Log Security 5441 + - Windows Event Log Security 5447 +search: |- + `wineventlog_security` + ( + ( + ( + EventCode=5447 + ChangeType IN ("%%16384", "Add") + ) + OR + EventCode=5441 + ) + Action IN ("%%16389", "Block") + FilterName="Custom Outbound Filter" + ) + + | eval user=coalesce(UserName,user,"unknown") + | eval filter_action=case(Action="%%16389","Block", true(), Action), + change_type=case(ChangeType="%%16384","Add", true(), ChangeType) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(filter_action) as filter_action + values(change_type) as change_type + values(ProviderName) as provider_name + values(FilterType) as filter_type + values(FilterId) as filter_id + values(FilterKey) as filter_key + values(LayerName) as layer_name + values(LayerId) as layer_id + values(Conditions) as conditions + values(CalloutName) as callout_name + BY dest user process_id FilterName + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_edrsilencer_custom_outbound_filter_added_filter` +how_to_implement: |- + To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447 and EventCode 5441. + The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events. +known_false_positives: |- + This filter name is associated with EDRSilencer behavior. + Validate whether any approved administrative tooling creates WFP block filters with the same name before tuning. +references: + - https://github.com/netero1010/EDRSilencer + - https://github.com/mthcht/awesome-lists/blob/main/Lists/Others/windows%20message%20tables/windows_messagetable_strings_list.csv + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447 + - https://learn.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: EDRSilencer WFP block filter [$FilterName$] was detected on [$dest$]. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: FilterName + type: signature +analytic_story: + - Disabling Security Tools + - Security Solution Tampering +asset_type: Endpoint +mitre_attack_id: + - T1685 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml b/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml new file mode 100644 index 0000000000..38d0ae316d --- /dev/null +++ b/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml @@ -0,0 +1,153 @@ +name: Windows Filtering Platform Filter Added To Block EDR Process +id: 8bb64b2a-299e-4ddc-a7e1-037bdc5b904a +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes. + Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name. + This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field. +data_source: + - Windows Event Log Security 5447 +search: |- + `wineventlog_security` + EventCode=5447 + ChangeType IN ("%%16384", "Add") + Action IN ("%%16389", "Block") + Conditions=* + + | eval conditions_text=coalesce(Conditions,"") + | rex mode=sed field=conditions_text "s/-/ /g" + | rex mode=sed field=conditions_text "s/[0-9A-Fa-f]{8}\s+([0-9A-Fa-f]{2}\s+){1,16}//g" + | eval conditions_normalized=lower(replace(conditions_text, "[^A-Za-z0-9]", "")) + | eval edr_process=case( + like(conditions_normalized, "%msmpengexe%"), "MsMpEng.exe", + like(conditions_normalized, "%mssenseexe%"), "MsSense.exe", + like(conditions_normalized, "%senseirexe%"), "SenseIR.exe", + like(conditions_normalized, "%sensendrexe%"), "SenseNdr.exe", + like(conditions_normalized, "%sensecncproxyexe%"), "SenseCncProxy.exe", + like(conditions_normalized, "%sensesampleuploaderexe%"), "SenseSampleUploader.exe", + like(conditions_normalized, "%winlogbeatexe%"), "winlogbeat.exe", + like(conditions_normalized, "%elasticagentexe%"), "elastic-agent.exe", + like(conditions_normalized, "%elasticendpointexe%"), "elastic-endpoint.exe", + like(conditions_normalized, "%filebeatexe%"), "filebeat.exe", + like(conditions_normalized, "%xagtexe%"), "xagt.exe", + like(conditions_normalized, "%qualysagentexe%"), "QualysAgent.exe", + like(conditions_normalized, "%sentinelagentexe%"), "SentinelAgent.exe", + like(conditions_normalized, "%sentinelagentworkerexe%"), "SentinelAgentWorker.exe", + like(conditions_normalized, "%sentinelservicehostexe%"), "SentinelServiceHost.exe", + like(conditions_normalized, "%sentinelstaticengineexe%"), "SentinelStaticEngine.exe", + like(conditions_normalized, "%logprocessorserviceexe%"), "LogProcessorService.exe", + like(conditions_normalized, "%sentinelstaticenginescannerexe%"), "SentinelStaticEngineScanner.exe", + like(conditions_normalized, "%sentinelhelperserviceexe%"), "SentinelHelperService.exe", + like(conditions_normalized, "%sentinelbrowsernativehostexe%"), "SentinelBrowserNativeHost.exe", + like(conditions_normalized, "%cylancesvcexe%"), "CylanceSvc.exe", + like(conditions_normalized, "%amsvcexe%"), "AmSvc.exe", + like(conditions_normalized, "%cramtrayexe%"), "CrAmTray.exe", + like(conditions_normalized, "%crssvcexe%"), "CrsSvc.exe", + like(conditions_normalized, "%executionpreventionsvcexe%"), "ExecutionPreventionSvc.exe", + like(conditions_normalized, "%cybereasonavexe%"), "CybereasonAV.exe", + like(conditions_normalized, "%cbexe%"), "cb.exe", + like(conditions_normalized, "%repmgrexe%"), "RepMgr.exe", + like(conditions_normalized, "%reputilsexe%"), "RepUtils.exe", + like(conditions_normalized, "%repuxexe%"), "RepUx.exe", + like(conditions_normalized, "%repwavexe%"), "RepWAV.exe", + like(conditions_normalized, "%repwscexe%"), "RepWSC.exe", + like(conditions_normalized, "%taniumclientexe%"), "TaniumClient.exe", + like(conditions_normalized, "%taniumcxexe%"), "TaniumCX.exe", + like(conditions_normalized, "%taniumdetectengineexe%"), "TaniumDetectEngine.exe", + like(conditions_normalized, "%trapsexe%"), "Traps.exe", + like(conditions_normalized, "%cyserverexe%"), "cyserver.exe", + like(conditions_normalized, "%cyveraserviceexe%"), "CyveraService.exe", + like(conditions_normalized, "%cyvrfsfltexe%"), "CyvrFsFlt.exe", + like(conditions_normalized, "%fortiedrexe%"), "fortiedr.exe", + like(conditions_normalized, "%sfcexe%"), "sfc.exe", + like(conditions_normalized, "%eiconnectorexe%"), "EIConnector.exe", + like(conditions_normalized, "%ekrnexe%"), "ekrn.exe", + like(conditions_normalized, "%hurukaiexe%"), "hurukai.exe", + like(conditions_normalized, "%cetasvcexe%"), "CETASvc.exe", + like(conditions_normalized, "%wscommunicatorexe%"), "WSCommunicator.exe", + like(conditions_normalized, "%endpointbasecampexe%"), "EndpointBasecamp.exe", + like(conditions_normalized, "%tmlistenexe%"), "TmListen.exe", + like(conditions_normalized, "%ntrtscanexe%"), "Ntrtscan.exe", + like(conditions_normalized, "%tmwscsvcexe%"), "TmWSCSvc.exe", + like(conditions_normalized, "%pccntmonexe%"), "PccNTMon.exe", + like(conditions_normalized, "%tmbmsrvexe%"), "TMBMSRV.exe", + like(conditions_normalized, "%cntaosmgrexe%"), "CNTAoSMgr.exe", + like(conditions_normalized, "%tmccsfexe%"), "TmCCSF.exe" + ) + | where isnotnull(edr_process) + | eval user=coalesce(UserName,user,"unknown") + + | eval filter_action=case(Action="%%16389","Block", true(), Action), + change_type=case(ChangeType="%%16384","Add", true(), ChangeType) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(filter_action) as filter_action + values(change_type) as change_type + values(edr_process) as edr_process + values(ProviderName) as provider_name + values(FilterType) as filter_type + values(FilterId) as filter_id + values(LayerName) as layer_name + values(LayerId) as layer_id + values(Conditions) as conditions + values(CalloutName) as callout_name + + BY dest user process_id FilterName + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_filtering_platform_filter_added_to_block_edr_process_filter` +how_to_implement: |- + To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447. The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events. +known_false_positives: |- + Legitimate firewall, VPN, EDR, and Group Policy changes can add WFP block filters. + Tune by approved ProviderName, LayerName, FilterName, or known administrative windows after validating the WFP filter context. +references: + - https://github.com/netero1010/EDRSilencer + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447 + - https://learn.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Windows Filtering Platform block filter targeting [$edr_process$] was detected on [$dest$]. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: edr_process + type: process_name + - field: FilterName + type: signature +analytic_story: + - Disabling Security Tools + - Security Solution Tampering +asset_type: Endpoint +mitre_attack_id: + - T1685 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml index 57fb47d17d..1c849a2aa4 100644 --- a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml +++ b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml @@ -1,38 +1,47 @@ name: Windows Set Account Password Policy To Unlimited Via Net id: 11f93009-8083-43fd-82a7-821fcbdc8342 -version: 7 +version: 8 creation_date: '2022-06-24' -modification_date: '2026-05-13' +modification_date: '2026-08-11' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects the use of net.exe to update user account policies to set passwords as non-expiring. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited" or "/maxpwage:49710", which achieve a similar outcome theoretically. This activity is significant as it can indicate an attempt to maintain persistence, escalate privileges, evade defenses, or facilitate lateral movement. If confirmed malicious, this behavior could allow an attacker to maintain long-term access to compromised accounts, potentially leading to further exploitation and unauthorized access to sensitive information. +description: |- + The following analytic detects the use of net.exe or net1.exe to configure the Windows maximum password age policy as unlimited. + It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and identifies executions of the `net accounts` command using the `/maxpwage:unlimited` option. + When specified, Windows configures the maximum password age with an unlimited value, effectively preventing passwords governed by the affected password policy from expiring. + This behavior is significant because an adversary may modify password expiration settings to weaken credential security controls and maintain access to compromised accounts for an extended period. + If confirmed malicious, this activity may indicate an attempt to establish or maintain persistence by preventing expected password rotation from invalidating credentials under the affected password policy. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE `process_net` - AND - Processes.process="* accounts *" - AND - (Processes.process="* /maxpwage:unlimited" - OR - Processes.process="/maxpwage:49710") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + `process_net` + Processes.process="* accounts *" + Processes.process IN ("* /maxpwage:unlimited*") + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_account_password_policy_to_unlimited_via_net_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: This behavior is not commonly seen in production environment and not advisable, filter as needed. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + This behavior is not commonly seen in production environment and not advisable, investigate the activity and determine if it is malicious. Apply additional filters to reduce false positives as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems @@ -51,6 +60,11 @@ intermediate_findings: type: system score: 20 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to make non-expiring password on host user accounts. +threat_objects: + - field: parent_process + type: parent_process + - field: process + type: process analytic_story: - Ransomware - BlackByte Ransomware From a5e1ffd6db629f7ddfc5232a8a50e2c3c88a6909 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 24 Aug 2026 15:40:44 +0200 Subject: [PATCH 082/164] Fix issues in batch - v6.5.0 (#4233) --- detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml | 2 +- .../linux_possible_append_command_to_profile_config_file.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml b/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml index f1845674e2..657033ef5a 100644 --- a/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml +++ b/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml @@ -35,5 +35,5 @@ category: web security_domain: network deprecation_info: reason: Detection deprecated as it is targeting a 6 years old CVE that is no longer relevant, since the OS version targeted is no longer supported by F5. As well, the fact that the detection has been set to experimental since 2020. - removed_in_version: 6.6.0 + removed_in_version: 6.8.0 replacement_content: [] diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index c6ae384782..e382b1d906 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -48,7 +48,7 @@ search: |- BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - process_current_directory Processes.process Processes.process_exec Processes.process_guid + Processes.process_current_directory Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product From 086196e9347c5be55f01920640e7c67763903656 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 25 Aug 2026 14:39:59 +0200 Subject: [PATCH 083/164] Update CODEOWNERS (#4234) --- .github/CODEOWNERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 058ddbe15f..d51104e081 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,3 +1,3 @@ -* @patel-bhavin @ljstella @nasbench @pyth0n1c @RavenTait @tccontre @rosplk @p4t12ick +* @patel-bhavin @ljstella @nasbench @pyth0n1c @RavenTait @tccontre @rosplk @p4t12ick @onurmerdogan /response_templates/ @kbouchardherjavecgroup @ccl0utier @henryy-splunk -/.github/workflows/response_templates/mcopenapi_public.yml @kbouchardherjavecgroup @ccl0utier @henryy-splunk \ No newline at end of file +/.github/workflows/response_templates/mcopenapi_public.yml @kbouchardherjavecgroup @ccl0utier @henryy-splunk From 9563bc31112ba537f0391af0bb40f9f9efa440d2 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 26 Aug 2026 12:35:06 -0700 Subject: [PATCH 084/164] updating minor text (#4237) --- detections/endpoint/excessive_usage_of_nslookup_app.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 413f138d49..89453e0e89 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -6,7 +6,7 @@ modification_date: '2026-08-24' author: Teoderick Contreras, Stanislav Miskovic, Splunk status: production type: Anomaly -description: The following analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It leverages Sysmon EventCode 1 to monitor process executions, specifically focusing on nslookup.exe. The detection identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious, this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses. +description: The following analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It leverages Sysmon EventCode 1 to monitor process executions, specifically focusing on nslookup.exe. The detection identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious,this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 From 0e6ea0aaf720dd5fb7687e35ce843be752b9f951 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 26 Aug 2026 22:37:08 +0200 Subject: [PATCH 085/164] Small Robot Fixes (#4238) * small fixes * Revert "small fixes" This reverts commit 07a1accbc57356750ef0fe0fbdeff867b51f54e8. * fixes --- .../linux_possible_append_command_to_profile_config_file.yml | 4 ++-- .../endpoint/python_network_traffic_during_package_build.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index e382b1d906..cd3a8eca4c 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -22,14 +22,14 @@ search: |- Processes.process = "*echo*" ( - Processes.process IN ("*/home/*", "*~/*") + Processes.process IN ("*/home/*", "*~/*", "*/etc/*") Processes.process IN ( "*/.bash_login*", "*/.bash_logout*", "*/.bash_profile*", "*/.bashrc*", "*/.profile*", - "*/etc/profile*" + "*/profile*" ) OR ( diff --git a/detections/endpoint/python_network_traffic_during_package_build.yml b/detections/endpoint/python_network_traffic_during_package_build.yml index eeb6f097b7..b5b36b69b2 100644 --- a/detections/endpoint/python_network_traffic_during_package_build.yml +++ b/detections/endpoint/python_network_traffic_during_package_build.yml @@ -46,7 +46,7 @@ search: |- by dest source process_id - | search process="* build_wheel*" + | search process="* build_wheel*" dest_ip=* | table firstTime lastTime parent_process_id parent_process_path parent_process_name parent_process From 870240cabb074a9ae0ae6522be5fd09786fca52c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 27 Aug 2026 15:28:48 -0700 Subject: [PATCH 086/164] Update data source TA and install.yml app versions (#4235) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- data_sources/azure_active_directory.yml | 2 +- ...e_directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- data_sources/azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_microsoftgraphactivitylogs.yml | 2 +- .../azure_active_directory_noninteractiveusersigninlogs.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- 23 files changed, 23 insertions(+), 23 deletions(-) diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index ff54229c4a..2d23314af0 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index dabaaa7d98..9b4849dfc4 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 148ad9f53d..d33f35db27 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 6a3682061c..23184c3e12 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index a89d51760a..bbbac95edf 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 86ec0e593c..5328a53ec2 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 2d3dddff8e..7d826f5370 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 10b5050e7b..8dec124377 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 2926d693c9..6dd0b04531 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 5c989625b7..1c33eb5297 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 51cf097b18..87b07760be 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 161a1d8a1a..82caf1ffca 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index bf82955119..27824f1429 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 3b2864dfe1..e3286081b2 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index ec07057d4d..ad9f821776 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 94311f56f8..8824c6cce7 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index adb75dd369..020e6ab111 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 81c651980d..c182874945 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 3b99c45001..4227fb1143 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index c08a28064f..9cc05a766c 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 6a5cb1015f..6c79156166 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 0527fe9105..caa8c9ca1a 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index c9824bf865..8aa47b20cf 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - column - action From 1e23c3e023e60ef9034cf66eb3858773cf9a77bd Mon Sep 17 00:00:00 2001 From: Casey McGinley <127444568+cmcginley-splunk@users.noreply.github.com> Date: Thu, 27 Aug 2026 15:32:30 -0700 Subject: [PATCH 087/164] chore: bump contentctl.yml and build.yml to 6.6.0 (#4240) Co-authored-by: research bot Co-authored-by: Nasreddine Bencherchali --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index aee844016c..b3a9aac053 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.5.0 +app_version: 6.6.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index b1f828f54e..116199c358 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.5.0 + version: 6.6.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 58f87ebacaa3a3e693fbe94883ba0e13cda4e0b6 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 31 Aug 2026 02:15:11 -0700 Subject: [PATCH 088/164] Update data source TA and install.yml app versions (#4246) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/g_suite_drive.yml | 2 +- data_sources/g_suite_gmail.yml | 2 +- data_sources/google_workspace.yml | 2 +- data_sources/google_workspace_login_failure.yml | 2 +- data_sources/google_workspace_login_success.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index b647bf3974..fb7e5f1b31 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -16,7 +16,7 @@ sourcetype: gsuite:drive:json supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - email diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 47a7e83990..2c599a4533 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -15,7 +15,7 @@ sourcetype: gsuite:gmail:bigquery supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - action_type diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index bde99e8ec1..8459c1a0de 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -10,7 +10,7 @@ sourcetype: gws:reports:login supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - action - actor.callerType diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index 774e7c8921..4e26bd7ec6 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -17,7 +17,7 @@ separator_value: login_failure supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - actor.email diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 727e82de8e..5701798e57 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -17,7 +17,7 @@ separator_value: login_success supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - actor.email From 6e80f2911c9ae6e6577ffbbcac0dc3bac76a4efa Mon Sep 17 00:00:00 2001 From: Cole Munz Date: Mon, 31 Aug 2026 04:17:45 -0500 Subject: [PATCH 089/164] Fix original_file_name field typo in whoami and arp discovery detections (#4245) Co-authored-by: Nasreddine Bencherchali --- .../endpoint/network_connection_discovery_with_arp.yml | 6 +++--- detections/endpoint/system_user_discovery_with_whoami.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/network_connection_discovery_with_arp.yml b/detections/endpoint/network_connection_discovery_with_arp.yml index 29915a8542..f1074df0d8 100644 --- a/detections/endpoint/network_connection_discovery_with_arp.yml +++ b/detections/endpoint/network_connection_discovery_with_arp.yml @@ -1,8 +1,8 @@ name: Network Connection Discovery With Arp id: ae008c0f-83bd-4ed4-9350-98d4328e15d2 -version: 10 +version: 11 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-08-30' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -22,7 +22,7 @@ search: |- ( Processes.process_name="arp.exe" OR - Processes.process_original_file_name="arp.exe" + Processes.original_file_name="arp.exe" ) Processes.process IN ( "* -a*", diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml index 952697b9f1..79d629583e 100644 --- a/detections/endpoint/system_user_discovery_with_whoami.yml +++ b/detections/endpoint/system_user_discovery_with_whoami.yml @@ -1,8 +1,8 @@ name: System User Discovery With Whoami id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 -version: 11 +version: 12 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-08-30' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -16,7 +16,7 @@ search: |- WHERE ( Processes.process_name="whoami.exe" OR - Processes.process_original_file_name="whoami.exe" + Processes.original_file_name="whoami.exe" ) BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid From ad15a0a3cb3ff29dca19160dd5bce30ebad89f78 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 1 Sep 2026 02:04:58 -0700 Subject: [PATCH 090/164] Update data source TA and install.yml app versions (#4252) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/cisco_secure_access_dns.yml | 2 +- data_sources/cisco_secure_access_firewall.yml | 2 +- data_sources/cisco_secure_access_proxy.yml | 2 +- data_sources/linux_auditd_add_user.yml | 2 +- data_sources/linux_auditd_cwd.yml | 2 +- data_sources/linux_auditd_daemon_abort.yml | 2 +- data_sources/linux_auditd_daemon_end.yml | 2 +- data_sources/linux_auditd_daemon_start.yml | 2 +- data_sources/linux_auditd_execve.yml | 2 +- data_sources/linux_auditd_path.yml | 2 +- data_sources/linux_auditd_proctitle.yml | 2 +- data_sources/linux_auditd_service_stop.yml | 2 +- data_sources/linux_auditd_syscall.yml | 2 +- data_sources/linux_messages_syslog.yml | 2 +- data_sources/linux_secure.yml | 2 +- 15 files changed, 15 insertions(+), 15 deletions(-) diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index 81ad956034..e1ce31ca6d 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:dns supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.53 + version: 1.0.54 fields: - RecordType - ReplyCode diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index d4cd0e777c..4faa2e264e 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -10,7 +10,7 @@ sourcetype: cisco:cloud_security:firewall supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.53 + version: 1.0.54 fields: - _time - action diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index b49c8c2dfe..1c96a73ef5 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:proxy supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.53 + version: 1.0.54 fields: - _time - action diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 835c71b6a8..e65107d021 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index 4922427446..3ef7f828d7 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index e311d74600..5446dd0ae7 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index 46c537bc68..6d4a8b2374 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 5c6aa25a0f..c22e10f484 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index 231d750fc2..ca072eadbb 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index b368989f15..2fb58ab7ac 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 1950f4a8eb..a344eab275 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index cdc8d643e7..124257f391 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index 5e99e36493..9993eff085 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 574409798e..93e9235f30 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -15,7 +15,7 @@ sourcetype: linux_messages_syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - _time - action diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 648850c8d0..5c10d18458 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - _time - action From da62dd80fa475b38ddb548838bae04c10742eb2d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 3 Sep 2026 02:27:20 -0700 Subject: [PATCH 091/164] Update data source TA and install.yml app versions (#4255) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/splunk_common_information_model_(cim).yml | 2 +- install.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/data_sources/splunk_common_information_model_(cim).yml b/data_sources/splunk_common_information_model_(cim).yml index b3be82871f..29dd90ca3f 100644 --- a/data_sources/splunk_common_information_model_(cim).yml +++ b/data_sources/splunk_common_information_model_(cim).yml @@ -10,4 +10,4 @@ sourcetype: not_applicable supported_TA: - name: Splunk Common Information Model (CIM) url: https://splunkbase.splunk.com/app/1621 - version: 8.6.0 + version: 8.7.0 diff --git a/install.yml b/install.yml index 1abe7d5b2b..f487b52fed 100644 --- a/install.yml +++ b/install.yml @@ -3,7 +3,7 @@ apps: hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz - appid: SplunkEnterpriseSecuritySuite url: https://splunkbase.splunk.com/app/263 - version: 8.6.1 + version: 8.7.0 - appid: Splunk_TA_microsoft-iis url: https://splunkbase.splunk.com/app/3185 version: 2.0.0 @@ -30,7 +30,7 @@ apps: version: 1.9.4 - appid: SA-admon url: https://splunkbase.splunk.com/app/6853 - version: 1.1.2 + version: 1.1.3 - appid: TA-crowdstrike-falcon-event-streams url: https://splunkbase.splunk.com/app/5082 version: 3.7.2 @@ -39,4 +39,4 @@ apps: version: 4.0.4 - appid: Splunk_SA_CIM url: https://splunkbase.splunk.com/app/1621 - version: 8.6.0 + version: 8.7.0 From ecb99de1319145b88bd8fecde1078bbec2c8aa79 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 3 Sep 2026 22:29:06 +0200 Subject: [PATCH 092/164] Add NIST RMF Dashboard [Alpha] (#4254) --- .../update_nist_ai_rmf_detection_map.yml | 58 + app_template/default/data/ui/nav/default.xml | 7 +- dashboards/nist_ai_rmf_control_coverage.json | 1032 +++++++++++++++++ dashboards/nist_ai_rmf_control_coverage.yml | 9 + lookups/csv/detection_subcategory_map.csv | 33 + lookups/csv/detection_subcategory_map.yml | 8 + lookups/csv/nist_ai_rmf_subcategories.csv | 73 ++ lookups/csv/nist_ai_rmf_subcategories.yml | 8 + .../generate_nist_ai_rmf_detection_map.py | 404 +++++++ .../nist_ai_rmf_data_sources.yml | 43 + 10 files changed, 1674 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/update_nist_ai_rmf_detection_map.yml create mode 100644 dashboards/nist_ai_rmf_control_coverage.json create mode 100644 dashboards/nist_ai_rmf_control_coverage.yml create mode 100644 lookups/csv/detection_subcategory_map.csv create mode 100644 lookups/csv/detection_subcategory_map.yml create mode 100644 lookups/csv/nist_ai_rmf_subcategories.csv create mode 100644 lookups/csv/nist_ai_rmf_subcategories.yml create mode 100644 scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py create mode 100644 scripts/nist_dashboard/nist_ai_rmf_data_sources.yml diff --git a/.github/workflows/update_nist_ai_rmf_detection_map.yml b/.github/workflows/update_nist_ai_rmf_detection_map.yml new file mode 100644 index 0000000000..96f4d998ac --- /dev/null +++ b/.github/workflows/update_nist_ai_rmf_detection_map.yml @@ -0,0 +1,58 @@ +name: NIST AI RMF Detection Map Update + +on: + workflow_dispatch: + schedule: + - cron: '25 06 * * *' + +permissions: + contents: write + pull-requests: write + +jobs: + update-nist-ai-rmf-detection-map: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + ref: develop + + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: '3.14' + architecture: x64 + + - name: Install Python dependencies + run: | + pip install PyYAML==6.0.3 + + - name: Generate NIST AI RMF detection map + run: | + python scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py --modified-date "$(date -u +%F)" + echo "Changed NIST AI RMF lookup files:" + git status --short -- lookups/csv/detection_subcategory_map.csv lookups/csv/detection_subcategory_map.yml + + - name: Create NIST AI RMF detection map update pull request + uses: peter-evans/create-pull-request@v8 + with: + token: ${{ github.token }} + commit-message: Update NIST AI RMF detection map + branch: auto-nist-ai-rmf-detection-map-${{ github.run_number }} + base: develop + title: Automated NIST AI RMF detection map update ${{ github.run_number }} + body: | + This PR updates the generated NIST AI RMF detection-to-subcategory lookup. + + The workflow runs: + + ```bash + python scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py --modified-date "$(date -u +%F)" + ``` + + When `lookups/csv/detection_subcategory_map.csv` changes, the generator also bumps `lookups/csv/detection_subcategory_map.yml` by incrementing `version` and setting `modification_date`. + add-paths: | + lookups/csv/detection_subcategory_map.csv + lookups/csv/detection_subcategory_map.yml diff --git a/app_template/default/data/ui/nav/default.xml b/app_template/default/data/ui/nav/default.xml index 6357d84701..1738ee9068 100644 --- a/app_template/default/data/ui/nav/default.xml +++ b/app_template/default/data/ui/nav/default.xml @@ -2,7 +2,12 @@ - + + + + + + Docs Explore in ES diff --git a/dashboards/nist_ai_rmf_control_coverage.json b/dashboards/nist_ai_rmf_control_coverage.json new file mode 100644 index 0000000000..1fc65b630c --- /dev/null +++ b/dashboards/nist_ai_rmf_control_coverage.json @@ -0,0 +1,1032 @@ +{ + "visualizations": { + "viz_BQYxvvZQ": { + "type": "splunk.markdown", + "options": { + "markdown": "# Configuration\n\n## Required lookups\n- `nist_ai_rmf_subcategories`: NIST AI RMF reference rows.\n- `detection_subcategory_map`: ESCU detection-to-RMF mapping.\n\n## Macros\n- Configure the AI detection macros for your environment: `mcp_server`, `m365_exported_ediscovery_prompt_logs`, `aws_bedrock_claude`, `ollama_server`, `cisco_ai_defense`.\n- Put index, source, and sourcetype constraints in macros.\n\n## Live findings\n- The Finding Window controls only live risk/notable panels. Coverage, inventory, and QA panels are lookup based.\n- Live panels read `index=risk` and `index=notable`.\n- Enable and schedule mapped ESCU detections and enable risk or notable output.\n- Supported saved-search title format: `ESCU - - Rule`." + } + }, + "viz_QTxzlSCU": { + "type": "splunk.singlevalue", + "options": { + "unit": "%", + "numberPrecision": 1, + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 75, + "value": "#4C8B5B" + }, + { + "from": 25, + "to": 75, + "value": "#C99A3B" + }, + { + "to": 25, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_BRlMOk7d" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Overall Coverage" + }, + "viz_cnGGAaf6": { + "type": "splunk.singlevalue", + "options": { + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 1, + "value": "#4C8B5B" + }, + { + "to": 1, + "value": "#C9CDD1" + } + ] + }, + "dataSources": { + "primary": "ds_gt18ik5M" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Covered Subcategories" + }, + "viz_7wqkM9gb": { + "type": "splunk.singlevalue", + "options": { + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 10, + "value": "#B5432F" + }, + { + "from": 1, + "to": 10, + "value": "#C99A3B" + }, + { + "to": 1, + "value": "#4C8B5B" + } + ] + }, + "dataSources": { + "primary": "ds_vZrhxFOJ" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Evidence Gaps" + }, + "viz_4Ftbhr59": { + "type": "splunk.singlevalue", + "options": { + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 1, + "value": "#2F6E7A" + }, + { + "to": 1, + "value": "#C9CDD1" + } + ] + }, + "dataSources": { + "primary": "ds_2SqA5f9A" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Evidence Mappings" + }, + "viz_eW41wskU": { + "type": "splunk.pie", + "options": { + "seriesColorsByField": { + "Covered": "#4C8B5B", + "No Automated Evidence": "#C9CDD1" + } + }, + "dataSources": { + "primary": "ds_63nvtA3f" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Overall Subcategory Coverage" + }, + "viz_73j82pok": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false + }, + "dataSources": { + "primary": "ds_eLy1BISV" + }, + "title": "Current AI Data Sources" + }, + "viz_kKUYcPFZ": { + "type": "splunk.column", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "yAxisTitleText": "Coverage %", + "yAxisMax": 100, + "seriesColorsByField": { + "coverage_pct": "#2F6E7A" + }, + "legendDisplay": "off" + }, + "dataSources": { + "primary": "ds_hS1OJKg4" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Coverage % by RMF Function" + }, + "viz_hnOFRoBD": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Issues": { + "rowBackgroundColors": "> table | seriesByName(\"Issues\") | rangeValue(IssuesColumnColorConfig)" + } + } + }, + "context": { + "IssuesColumnColorConfig": [ + { + "to": 1, + "value": "#8FBC8F" + }, + { + "from": 1, + "to": 5, + "value": "#C99A3B" + }, + { + "from": 5, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_OrjFXleV" + }, + "title": "Lookup QA" + }, + "viz_rBY5q7BC": { + "type": "splunk.table", + "options": { + "count": 5, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Gaps": { + "rowBackgroundColors": "> table | seriesByName(\"Gaps\") | rangeValue(GapsColumnColorConfig)" + } + } + }, + "context": { + "GapsColumnColorConfig": [ + { + "to": 2, + "value": "#C9CDD1" + }, + { + "from": 2, + "to": 5, + "value": "#C99A3B" + }, + { + "from": 5, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_7kk8BZgQ" + }, + "title": "Coverage Gaps by Category" + }, + "viz_6bpl5nqi": { + "type": "splunk.table", + "options": { + "count": 15, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Coverage Score": { + "rowBackgroundColors": "> table | seriesByName(\"Coverage Score\") | rangeValue(CoverageScoreColumnColorConfig)" + }, + "Confidence": { + "rowBackgroundColors": "> table | seriesByName(\"Confidence\") | matchValue(ConfidenceColumnColorConfig)" + }, + "Status": { + "rowBackgroundColors": "> table | seriesByName(\"Status\") | matchValue(StatusColumnColorConfig)" + } + } + }, + "context": { + "CoverageScoreColumnColorConfig": [ + { + "to": 1, + "value": "#D3D3D3" + }, + { + "from": 1, + "to": 80, + "value": "#E8C66A" + }, + { + "from": 80, + "to": 100, + "value": "#8FBC8F" + }, + { + "from": 100, + "value": "#4C8B5B" + } + ], + "ConfidenceColumnColorConfig": [ + { + "match": "Production detection", + "value": "#8FBC8F" + }, + { + "match": "High-confidence mapping", + "value": "#CFE8D4" + }, + { + "match": "Mapped evidence", + "value": "#E8C66A" + }, + { + "match": "Gap", + "value": "#D3D3D3" + } + ], + "StatusColumnColorConfig": [ + { + "match": "Covered", + "value": "#8FBC8F" + }, + { + "match": "No Automated Evidence", + "value": "#D3D3D3" + } + ] + }, + "dataSources": { + "primary": "ds_Twm3TjaW" + }, + "title": "NIST AI RMF Coverage Matrix" + }, + "viz_DsBuvQrU": { + "type": "splunk.bar", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "stackMode": "stacked", + "xAxisTitleText": "Detections", + "seriesColorsByField": { + "High confidence": "#4C8B5B", + "Medium confidence": "#C99A3B", + "Needs review": "#B5432F", + "Validated legacy": "#2F6E7A", + "Mapped": "#C9CDD1" + }, + "legendDisplay": "right" + }, + "dataSources": { + "primary": "ds_985blmZV" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Mapping Confidence by AI System" + }, + "viz_kSKQYeUh": { + "type": "splunk.column", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "stackMode": "stacked", + "yAxisTitleText": "Findings", + "seriesColorsByField": { + "critical": "#7A1F1F", + "high": "#B5432F", + "medium": "#C99A3B", + "low": "#4C8B5B", + "info": "#C9CDD1" + }, + "legendDisplay": "right" + }, + "dataSources": { + "primary": "ds_GuKtVyMD" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Recent Finding Volume" + }, + "viz_xPLJvtKV": { + "type": "splunk.line", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "yAxisTitleText": "Findings", + "seriesColorsByField": { + "MCP": "#2F6E7A", + "M365 Copilot": "#96702C", + "AWS Bedrock Claude": "#4C8B5B", + "Ollama": "#B5432F", + "No live findings": "#C9CDD1" + }, + "legendDisplay": "right" + }, + "dataSources": { + "primary": "ds_baqBk8nw" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Recent Findings Over Time" + }, + "viz_Rn9Wgakt": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Findings": { + "rowBackgroundColors": "> table | seriesByName(\"Findings\") | rangeValue(FindingsColumnColorConfig)" + } + } + }, + "context": { + "FindingsColumnColorConfig": [ + { + "to": 2, + "value": "#C9CDD1" + }, + { + "from": 2, + "to": 5, + "value": "#C99A3B" + }, + { + "from": 5, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_dm3yXtFo" + }, + "title": "Top Active Entities" + }, + "viz_FSxVef4D": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "severity": { + "rowBackgroundColors": "> table | seriesByName(\"severity\") | matchValue(severityColumnColorConfig)" + } + } + }, + "context": { + "severityColumnColorConfig": [ + { + "match": "critical", + "value": "#7A1F1F" + }, + { + "match": "high", + "value": "#B5432F" + }, + { + "match": "medium", + "value": "#E8C66A" + }, + { + "match": "low", + "value": "#8FBC8F" + }, + { + "match": "info", + "value": "#C9CDD1" + } + ] + }, + "dataSources": { + "primary": "ds_zqqriYdp" + }, + "title": "Recent Findings Detail" + }, + "viz_liveReadiness": { + "type": "splunk.table", + "options": { + "count": 10, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Readiness": { + "rowBackgroundColors": "> table | seriesByName(\"Readiness\") | matchValue(ReadinessColumnColorConfig)" + } + } + }, + "context": { + "ReadinessColumnColorConfig": [ + { + "match": "Ready", + "value": "#8FBC8F" + }, + { + "match": "Disabled", + "value": "#E8C66A" + }, + { + "match": "Not scheduled", + "value": "#E8C66A" + }, + { + "match": "No risk/notable action", + "value": "#C99A3B" + }, + { + "match": "Missing saved search", + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_live_readiness" + }, + "title": "Live Findings Readiness" + } + }, + "dataSources": { + "ds_coverage_base": { + "type": "ds.search", + "options": { + "query": "| inputlookup nist_ai_rmf_subcategories\n| eval rmf_row=1\n| fields function category_id subcategory_id subcategory_text rmf_row\n| append\n [ | inputlookup detection_subcategory_map\n | eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n | where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n | eval subcategory_ids=split(coalesce(subcategory_ids,\"\"), \"|\")\n | mvexpand subcategory_ids\n | eval subcategory_id=trim(subcategory_ids)\n | where subcategory_id!=\"\"\n | eval mapped_detection=1\n | eval production_detection=if(lower(coalesce(detection_status,\"\"))==\"production\", 1, 0)\n | eval mapping_confidence=lower(coalesce(mapping_confidence,\"mapped\"))\n | eval mapping_state=case(\n mapping_confidence==\"validated\", \"Validated legacy evidence\",\n mapping_confidence==\"high\", \"High-confidence mapping\",\n mapping_confidence==\"medium\", \"Medium-confidence mapping\",\n mapping_confidence==\"review\", \"Review mapping\",\n mapping_confidence==\"mapped\", \"Mapped legacy evidence\",\n true(), \"Mapped evidence\")\n | fields subcategory_id detection_name ai_system mapped_detection production_detection mapping_confidence mapping_state mapping_source mapping_reason detection_status detection_type analytic_stories data_sources ]\n| stats values(function) as function values(category_id) as category_id values(subcategory_text) as subcategory_text values(detection_name) as detections values(ai_system) as ai_systems dc(detection_name) as detection_count sum(mapped_detection) as mapped_rows sum(production_detection) as production_detections values(mapping_confidence) as mapping_confidence values(mapping_state) as mapping_state values(mapping_source) as mapping_source values(detection_status) as detection_status by subcategory_id\n| eval function=mvindex(function,0), category_id=mvindex(category_id,0), subcategory_text=mvindex(subcategory_text,0)\n| where isnotnull(function) AND isnotnull(category_id)\n| eval detection_count=coalesce(detection_count,0), mapped_rows=coalesce(mapped_rows,0), production_detections=coalesce(production_detections,0)\n| eval status=if(detection_count>0,\"Covered\",\"No Automated Evidence\")\n| eval mapping_confidence_text=mvjoin(mapping_confidence,\"|\")\n| eval confidence=case(production_detections>0,\"Production detection\", match(mapping_confidence_text,\"high\"),\"High-confidence mapping\", detection_count>0,\"Mapped evidence\", true(),\"Gap\")\n| eval selected_function=case($function_filter|s$==\"GOVERN\" OR $function_filter|s$==\"MAP\" OR $function_filter|s$==\"MEASURE\" OR $function_filter|s$==\"MANAGE\", $function_filter|s$, true(), \"*\")\n| where selected_function==\"*\" OR function==selected_function\n| fields - selected_function\n| eval selected_status=case($status_filter|s$==\"Covered\" OR $status_filter|s$==\"No Automated Evidence\", $status_filter|s$, true(), \"*\")\n| where selected_status==\"*\" OR status==selected_status\n| fields - selected_status mapping_confidence_text\n| table function category_id subcategory_id subcategory_text status confidence detection_count production_detections detections ai_systems mapping_state mapping_source detection_status", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "ds_coverage_base" + }, + "ds_live_findings_base": { + "type": "ds.search", + "options": { + "query": "search (index=risk OR index=notable)\n [ | inputlookup detection_subcategory_map\n | eval selected_ai_system=$ai_system_filter|s$\n | eval selected_ai_system=case(len(selected_ai_system)==0 OR selected_ai_system==\"*\" OR selected_ai_system==\"__all__\" OR match(selected_ai_system, \"^\\$.*\\$$\"), \"*\", true(), selected_ai_system)\n | where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n | eval savedsearch_title=if(match(detection_name,\"^ESCU - .+ - Rule$\"), detection_name, \"ESCU - \".detection_name.\" - Rule\")\n | eval savedsearch_title=trim(savedsearch_title)\n | where match(savedsearch_title,\"^ESCU - [A-Za-z0-9][A-Za-z0-9 _.\\-]{0,180} - Rule$\")\n | stats values(savedsearch_title) as savedsearch_title dc(savedsearch_title) as savedsearch_count\n | eval quoted=\"\\\"\".mvjoin(savedsearch_title,\"\\\",\\\"\").\"\\\"\"\n | eval search=if(savedsearch_count>0, \"(source IN (\".quoted.\") OR search_name IN (\".quoted.\") OR savedsearch_name IN (\".quoted.\") OR orig_source IN (\".quoted.\") OR rule_name IN (\".quoted.\"))\", \"source=\\\"__nist_ai_no_match__\\\"\")\n | return $search ]\n| eval finding_source=case(index=\"risk\",\"risk\", index=\"notable\",\"notable\", true(),index)\n| eval savedsearch_title=coalesce(if(match(search_name,\"^ESCU - .+ - Rule$\"),search_name,null()), if(match(source,\"^ESCU - .+ - Rule$\"),source,null()), if(match(savedsearch_name,\"^ESCU - .+ - Rule$\"),savedsearch_name,null()), if(match(rule_name,\"^ESCU - .+ - Rule$\"),rule_name,null()), if(match(orig_source,\"^ESCU - .+ - Rule$\"),orig_source,null()))\n| where isnotnull(savedsearch_title)\n| rex field=savedsearch_title \"^ESCU - (?.*?)(?: - Rule)?$\"\n| lookup detection_subcategory_map detection_name as detection OUTPUT ai_system subcategory_ids rmf_function analytic_stories\n| where isnotnull(ai_system)\n| eval nist_ai_finding_event_id=coalesce(event_id, source_event_id, sid, _cd, tostring(_time).\"|\".savedsearch_title.\"|\".coalesce(risk_object,\"\").\"|\".coalesce(dest,\"\").\"|\".coalesce(user,\"\").\"|\".coalesce(_raw,\"\"))\n| dedup nist_ai_finding_event_id detection\n| eval risk_numeric=tonumber(coalesce(calculated_risk_score, risk_score))\n| eval severity=case(\n finding_source=\"risk\", lower(coalesce(severity, case(risk_numeric>=80,\"critical\", risk_numeric>=50,\"high\", risk_numeric>=20,\"medium\", risk_numeric>0,\"low\", true(),\"unknown\"))),\n finding_source=\"notable\", lower(coalesce(severity, urgency, \"unknown\")),\n true(), lower(coalesce(severity,\"unknown\")))\n| eval entity=case(\n finding_source=\"risk\", coalesce(risk_object, normalized_risk_object, user, dest, src, host, \"unknown\"),\n finding_source=\"notable\", coalesce(risk_object, normalized_risk_object, user, dest, src, host, rule_name, \"unknown\"),\n true(), coalesce(risk_object, normalized_risk_object, user, dest, src, host, \"unknown\"))\n| eval target=case(\n finding_source=\"risk\", coalesce(risk_object_type, dest, src, user, host, \"\"),\n finding_source=\"notable\", coalesce(dest, src, user, host, \"\"),\n true(), coalesce(dest, src, user, host, \"\"))\n| eval detail=case(\n finding_source=\"risk\", coalesce(risk_message, source, search_name, detection, \"\"),\n finding_source=\"notable\", coalesce(rule_description, description, rule_name, detection, \"\"),\n true(), coalesce(risk_message, rule_description, source, detection, \"\"))\n| eval finding_type=case(finding_source=\"risk\", coalesce(analyticstories, rmf_function, \"Risk event\"), finding_source=\"notable\", coalesce(rmf_function, \"Notable event\"), true(), coalesce(rmf_function,\"Finding\"))\n| eval entity=coalesce(entity,\"unknown\")\n| eval source=coalesce(source, finding_source)\n| eval target=coalesce(target,\"\")\n| eval detail=substr(coalesce(detail,\"\"),1,500)\n| fields _time finding_source ai_system detection finding_type severity entity source target detail", + "queryParameters": { + "earliest": "$global_time.earliest$", + "latest": "$global_time.latest$" + } + }, + "name": "ds_live_findings_base" + }, + "ds_tvTy8Bkv": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| where isnotnull(ai_system) AND ai_system!=\"\"\n| stats count by ai_system\n| sort ai_system", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "AI System search" + }, + "ds_BRlMOk7d": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count as total count(eval(status==\"Covered\")) as covered\n| eval pct=if(total=0,0,round(100*covered/total,1))\n| fields pct" + }, + "name": "Overall Coverage - Single value search" + }, + "ds_gt18ik5M": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count(eval(status==\"Covered\")) as covered\n| fields covered" + }, + "name": "Covered Subcategories - Single value search" + }, + "ds_vZrhxFOJ": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count(eval(status==\"No Automated Evidence\")) as gaps\n| fields gaps" + }, + "name": "Evidence Gaps - Single value search" + }, + "ds_2SqA5f9A": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats sum(detection_count) as mapped_evidence\n| eval mapped_evidence=coalesce(mapped_evidence,0)\n| fields mapped_evidence" + }, + "name": "Evidence Mappings - Single value search" + }, + "ds_63nvtA3f": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count by status\n| sort status" + }, + "name": "Overall Subcategory Coverage - Pie chart search" + }, + "ds_eLy1BISV": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n| where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n| where isnotnull(ai_system) AND ai_system!=\"\"\n| eval data_sources=coalesce(data_sources, ai_system)\n| eval data_source_list=split(data_sources,\"|\")\n| eval subcategory_ids=split(coalesce(subcategory_ids,\"\"), \"|\")\n| eval mapped_subcategories=mvcount(subcategory_ids)\n| eval production_detection=if(lower(coalesce(detection_status,\"\"))==\"production\", 1, 0)\n| eval mapping_confidence=lower(coalesce(mapping_confidence,\"mapped\"))\n| eval mapping_confidence=case(mapping_confidence==\"high\",\"High confidence\", mapping_confidence==\"medium\",\"Medium confidence\", mapping_confidence==\"review\",\"Needs review\", mapping_confidence==\"validated\",\"Validated legacy\", true(),\"Mapped\")\n| stats dc(detection_name) as detections values(data_source_list) as data_sources sum(mapped_subcategories) as mapped_subcategories sum(production_detection) as production_detections values(mapping_confidence) as mapping_confidence by ai_system\n| eval data_sources=mvjoin(mvsort(data_sources), \", \")\n| eval mapping_confidence=mvjoin(mvsort(mapping_confidence), \", \")\n| sort -detections ai_system\n| rename ai_system as \"AI System\", data_sources as \"Data Sources\", detections as \"Detections\", mapped_subcategories as \"Mapped Subcategories\", production_detections as \"Production Detections\", mapping_confidence as \"Mapping Confidence\"\n| table \"AI System\" \"Data Sources\" Detections \"Mapped Subcategories\" \"Production Detections\" \"Mapping Confidence\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Current AI Data Sources - Table search" + }, + "ds_hS1OJKg4": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count as total count(eval(status==\"Covered\")) as covered_n by function\n| eval coverage_pct=if(total=0,0,round(100*covered_n/total,1))\n| eval function_order=case(function=\"GOVERN\",1,function=\"MAP\",2,function=\"MEASURE\",3,function=\"MANAGE\",4,true(),99)\n| sort function_order\n| table function coverage_pct" + }, + "name": "Coverage % by RMF Function - Column chart search" + }, + "ds_OrjFXleV": { + "type": "ds.search", + "options": { + "query": "| makeresults\n| eval qa_check=\"Invalid subcategory IDs|Blank AI systems|Blank data sources|Duplicate mappings|Review mappings|Unexpected validated_count|Unsafe detection names\"\n| makemv delim=\"|\" qa_check\n| mvexpand qa_check\n| eval issue_count=0, examples=\"\"\n| append\n [ | inputlookup detection_subcategory_map\n | eval subcategory_ids=split(coalesce(subcategory_ids,\"\"),\"|\")\n | mvexpand subcategory_ids\n | eval subcategory_id=trim(subcategory_ids)\n | eval mapped=1\n | fields detection_name ai_system subcategory_id mapped\n | append\n [ | inputlookup nist_ai_rmf_subcategories\n | eval valid_rmf=1\n | fields subcategory_id valid_rmf ]\n | stats max(mapped) as mapped max(valid_rmf) as valid_rmf values(detection_name) as detections by subcategory_id\n | where mapped==1 AND isnull(valid_rmf)\n | eval qa_check=\"Invalid subcategory IDs\", examples=subcategory_id.\" / \".mvindex(detections,0), issue_count=1\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | where isnull(ai_system) OR trim(ai_system)==\"\"\n | eval qa_check=\"Blank AI systems\", issue_count=1, examples=coalesce(detection_name,\"\")\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval data_sources=coalesce(data_sources,\"\")\n | where isnull(data_sources) OR trim(data_sources)==\"\"\n | eval qa_check=\"Blank data sources\", issue_count=1, examples=coalesce(detection_name,\"\")\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval subcategory_ids=split(coalesce(subcategory_ids,\"\"),\"|\")\n | mvexpand subcategory_ids\n | eval subcategory_id=trim(subcategory_ids)\n | stats count as duplicate_count by detection_name ai_system subcategory_id\n | where duplicate_count>1\n | eval qa_check=\"Duplicate mappings\", issue_count=duplicate_count-1, examples=detection_name.\" / \".ai_system.\" / \".subcategory_id\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval mapping_confidence=lower(coalesce(mapping_confidence,\"\")), mapping_source=lower(coalesce(mapping_source,\"\"))\n | where mapping_confidence==\"review\" OR mapping_source==\"generated_review\"\n | eval qa_check=\"Review mappings\", issue_count=1, examples=coalesce(detection_name,\"\").\" / \".coalesce(mapping_reason,\"\")\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | where isnotnull(validated_count)\n | eval validated_count=trim(tostring(validated_count))\n | where validated_count!=\"\" AND lower(validated_count)!=\"null\" AND NOT match(validated_count,\"^[0-9]+$\")\n | eval qa_check=\"Unexpected validated_count\", issue_count=1, examples=coalesce(detection_name,\"\").\" / \".validated_count\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval expected_savedsearch=if(match(detection_name,\"^ESCU - .+ - Rule$\"), detection_name, \"ESCU - \".detection_name.\" - Rule\")\n | eval expected_savedsearch=trim(expected_savedsearch)\n | where NOT match(expected_savedsearch,\"^ESCU - [A-Za-z0-9][A-Za-z0-9 _.\\-]{0,180} - Rule$\")\n | eval qa_check=\"Unsafe detection names\", issue_count=1, examples=coalesce(detection_name,\"\")\n | fields qa_check issue_count examples ]\n| stats sum(issue_count) as Issues values(examples) as examples by qa_check\n| eval examples=mvfilter(examples!=\"\")\n| eval Examples=mvjoin(mvindex(examples,0,5), \"; \")\n| rename qa_check as \"QA Check\"\n| table \"QA Check\" Issues Examples\n| sort -Issues \"QA Check\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Lookup QA - Table search" + }, + "ds_7kk8BZgQ": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| where status==\"No Automated Evidence\"\n| stats count as gaps values(subcategory_id) as subcategories by function category_id\n| rename function as Function, category_id as Category, gaps as Gaps, subcategories as Subcategories\n| sort -Gaps Function Category" + }, + "name": "Coverage Gaps by Category - Table search" + }, + "ds_Twm3TjaW": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| eval coverage_score=case(confidence==\"Production detection\",100, confidence==\"High-confidence mapping\",80, confidence==\"Mapped evidence\",60, true(),0)\n| eval function_order=case(function=\"GOVERN\",1,function=\"MAP\",2,function=\"MEASURE\",3,function=\"MANAGE\",4,true(),99)\n| sort function_order category_id subcategory_id\n| rename function as Function, category_id as Category, subcategory_id as Subcategory, coverage_score as \"Coverage Score\", confidence as Confidence, detection_count as Detections, production_detections as \"Production Detections\", ai_systems as \"AI Systems\", subcategory_text as \"Subcategory Text\", mapping_state as \"Mapping State\", detection_status as \"Detection Status\", status as Status\n| table Function Category Subcategory \"Coverage Score\" Confidence Detections \"Production Detections\" \"AI Systems\" \"Mapping State\" \"Detection Status\" \"Subcategory Text\" Status" + }, + "name": "NIST AI RMF Coverage Detail - Table search" + }, + "ds_985blmZV": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n| where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n| where isnotnull(ai_system) AND ai_system!=\"\"\n| eval mapping_confidence=lower(coalesce(mapping_confidence,\"mapped\"))\n| eval mapping_confidence=case(mapping_confidence==\"high\",\"High confidence\", mapping_confidence==\"medium\",\"Medium confidence\", mapping_confidence==\"review\",\"Needs review\", mapping_confidence==\"validated\",\"Validated legacy\", true(),\"Mapped\")\n| stats count as detections by ai_system mapping_confidence\n| chart sum(detections) over ai_system by mapping_confidence\n| fillnull value=0", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Mapping Confidence by AI System - Bar chart search" + }, + "ds_GuKtVyMD": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| chart count over ai_system by severity\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval ai_system=\"No live findings\", info=0\n | fields - result_count ]\n| fillnull value=0" + }, + "name": "Recent Finding Volume - Column chart search" + }, + "ds_baqBk8nw": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| timechart count by ai_system\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval _time=now(), \"No live findings\"=0\n | fields _time \"No live findings\" ]\n| fillnull value=0" + }, + "name": "Recent Findings Over Time - Line chart search" + }, + "ds_dm3yXtFo": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| stats count as findings dc(detection) as detection_types values(ai_system) as ai_systems values(severity) as severities values(finding_source) as finding_sources max(_time) as last_time by entity\n| eval lastSeen=strftime(last_time,\"%Y-%m-%d %H:%M:%S\")\n| rename entity as Entity, findings as Findings, detection_types as \"Detection Types\", ai_systems as \"AI Systems\", severities as Severities, finding_sources as \"Finding Sources\", lastSeen as \"Last Seen\"\n| sort -Findings\n| table Entity Findings \"Detection Types\" \"AI Systems\" Severities \"Finding Sources\" \"Last Seen\"\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval Entity=\"No live findings\", Findings=0, \"Detection Types\"=\"Enable and schedule mapped AI detections\", \"AI Systems\"=\"Check Live Findings Readiness\", Severities=\"info\", \"Finding Sources\"=\"risk/notable\", \"Last Seen\"=\"No events in selected Finding Window\"\n | fields - result_count ]" + }, + "name": "Top Active Entities - Table search" + }, + "ds_zqqriYdp": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| eval eventTime=strftime(_time,\"%Y-%m-%d %H:%M:%S\")\n| sort -_time\n| rename finding_source as source_type\n| table eventTime source_type ai_system severity entity detection target detail\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval eventTime=\"\", source_type=\"Configuration\", ai_system=\"No live findings\", severity=\"info\", entity=\"No risk/notable events in selected window\", detection=\"Enable and schedule mapped AI detections\", target=\"\", detail=\"All mapped detections are disabled or no risk/notable output has been generated. Check Live Findings Readiness.\"\n | fields - result_count ]" + }, + "name": "Recent Findings Detail - Table search" + }, + "ds_live_readiness": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n| where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n| eval expected_savedsearch=if(match(detection_name,\"^ESCU - .+ - Rule$\"), detection_name, \"ESCU - \".detection_name.\" - Rule\")\n| eval expected_savedsearch=trim(expected_savedsearch)\n| where match(expected_savedsearch,\"^ESCU - [A-Za-z0-9][A-Za-z0-9 _.\\-]{0,180} - Rule$\")\n| eval mapped=1\n| fields ai_system data_sources detection_name expected_savedsearch mapped\n| append\n [ | rest /servicesNS/-/-/saved/searches splunk_server=local\n | rename title as expected_savedsearch\n | eval savedsearch_present=1\n | eval enabled=if(disabled==0 OR disabled==\"0\",\"Enabled\",\"Disabled\")\n | eval scheduled=if(is_scheduled==1 OR is_scheduled==\"1\",\"Scheduled\",\"Not scheduled\")\n | eval finding_output=case(match(actions,\"(^|,)risk(,|$)\") OR 'action.risk'==1 OR 'action.risk'==\"1\",\"Risk\", match(actions,\"(^|,)notable(,|$)\") OR 'action.notable'==1 OR 'action.notable'==\"1\",\"Notable\", true(),\"No risk/notable\")\n | eval schedule=coalesce(cron_schedule,\"\"), window=coalesce('dispatch.earliest_time',\"\").\" to \".coalesce('dispatch.latest_time',\"\")\n | fields expected_savedsearch savedsearch_present enabled scheduled finding_output schedule window ]\n| stats max(mapped) as mapped values(ai_system) as ai_system values(data_sources) as data_sources values(detection_name) as detection_name max(savedsearch_present) as savedsearch_present values(enabled) as enabled values(scheduled) as scheduled values(finding_output) as finding_output values(schedule) as schedule values(window) as window by expected_savedsearch\n| where mapped==1\n| eval present=if(savedsearch_present==1,\"Present\",\"Missing\")\n| eval enabled=coalesce(mvindex(enabled,0),\"Missing\")\n| eval scheduled=coalesce(mvindex(scheduled,0),\"Missing\")\n| eval finding_output=coalesce(mvindex(finding_output,0),\"Missing\")\n| eval readiness=case(present==\"Missing\",\"Missing saved search\", enabled!=\"Enabled\",\"Disabled\", scheduled!=\"Scheduled\",\"Not scheduled\", finding_output==\"No risk/notable\",\"No risk/notable action\", true(),\"Ready\")\n| eval data_sources=mvjoin(mvsort(data_sources),\", \")\n| eval schedule=coalesce(mvindex(schedule,0),\"\"), window=coalesce(mvindex(window,0),\"\")\n| sort readiness ai_system detection_name\n| rename ai_system as \"AI System\", detection_name as Detection, expected_savedsearch as \"Saved Search\", readiness as Readiness, finding_output as \"Finding Output\", schedule as Schedule, window as Window, data_sources as \"Data Sources\"\n| table \"AI System\" Detection \"Saved Search\" Readiness \"Finding Output\" Schedule Window \"Data Sources\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Live Findings Readiness - Table search" + } + }, + "defaults": { + "dataSources": { + "ds.search": { + "options": { + "queryParameters": { + "latest": "$global_time.latest$", + "earliest": "$global_time.earliest$" + } + } + } + } + }, + "inputs": { + "input_JACuzsvA": { + "type": "input.timerange", + "options": { + "token": "global_time", + "defaultValue": "-90d@d,now" + }, + "title": "Finding Window" + }, + "input_3BYkUTy7": { + "type": "input.dropdown", + "options": { + "defaultValue": "*", + "items": [ + { + "value": "*", + "label": "All functions" + }, + { + "value": "GOVERN", + "label": "GOVERN" + }, + { + "value": "MAP", + "label": "MAP" + }, + { + "value": "MEASURE", + "label": "MEASURE" + }, + { + "value": "MANAGE", + "label": "MANAGE" + } + ], + "token": "function_filter" + }, + "title": "RMF Function" + }, + "input_rjZO3BZq": { + "type": "input.dropdown", + "options": { + "defaultValue": "*", + "items": [ + { + "value": "*", + "label": "All statuses" + }, + { + "value": "Covered", + "label": "Covered" + }, + { + "value": "No Automated Evidence", + "label": "No Automated Evidence" + } + ], + "token": "status_filter" + }, + "title": "Coverage Status" + }, + "input_jgTDQthW": { + "type": "input.dropdown", + "options": { + "defaultValue": "__all__", + "items": ">frame(label, value) | prepend(formattedStatics) | objects()", + "token": "ai_system_filter" + }, + "title": "AI System", + "context": { + "formattedConfig": { + "number": { + "prefix": "" + } + }, + "formattedStatics": ">statics | formatByType(formattedConfig)", + "statics": [ + [ + "All AI systems" + ], + [ + "__all__" + ] + ], + "label": ">primary | seriesByName(\"ai_system\") | renameSeries(\"label\") | formatByType(formattedConfig)", + "value": ">primary | seriesByName(\"ai_system\") | renameSeries(\"value\") | formatByType(formattedConfig)" + }, + "dataSources": { + "primary": "ds_tvTy8Bkv" + } + } + }, + "layout": { + "type": "grid", + "options": { + "submitButton": false, + "height": 4460, + "width": 1440, + "submitOnDashboardLoad": true + }, + "structure": [ + { + "item": "viz_BQYxvvZQ", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 390 + } + }, + { + "item": "viz_QTxzlSCU", + "type": "block", + "position": { + "x": 0, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_cnGGAaf6", + "type": "block", + "position": { + "x": 360, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_7wqkM9gb", + "type": "block", + "position": { + "x": 720, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_4Ftbhr59", + "type": "block", + "position": { + "x": 1080, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_eW41wskU", + "type": "block", + "position": { + "x": 0, + "y": 600, + "w": 720, + "h": 300 + } + }, + { + "item": "viz_73j82pok", + "type": "block", + "position": { + "x": 720, + "y": 600, + "w": 720, + "h": 300 + } + }, + { + "item": "viz_kKUYcPFZ", + "type": "block", + "position": { + "x": 0, + "y": 900, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_hnOFRoBD", + "type": "block", + "position": { + "x": 0, + "y": 1180, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_rBY5q7BC", + "type": "block", + "position": { + "x": 0, + "y": 1460, + "w": 1440, + "h": 420 + } + }, + { + "item": "viz_6bpl5nqi", + "type": "block", + "position": { + "x": 0, + "y": 1880, + "w": 1440, + "h": 520 + } + }, + { + "item": "viz_DsBuvQrU", + "type": "block", + "position": { + "x": 0, + "y": 2400, + "w": 1440, + "h": 300 + } + }, + { + "item": "viz_kSKQYeUh", + "type": "block", + "position": { + "x": 0, + "y": 3060, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_liveReadiness", + "type": "block", + "position": { + "x": 0, + "y": 2700, + "w": 1440, + "h": 360 + } + }, + { + "item": "viz_xPLJvtKV", + "type": "block", + "position": { + "x": 0, + "y": 3340, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_Rn9Wgakt", + "type": "block", + "position": { + "x": 0, + "y": 3620, + "w": 1440, + "h": 420 + } + }, + { + "item": "viz_FSxVef4D", + "type": "block", + "position": { + "x": 0, + "y": 4040, + "w": 1440, + "h": 420 + } + } + ], + "globalInputs": [ + "input_JACuzsvA", + "input_3BYkUTy7", + "input_rjZO3BZq", + "input_jgTDQthW" + ] + }, + "description": "Maps AI-related ESCU detections and ESCU-generated risk/notable findings to NIST AI RMF subcategories for coverage review, gap analysis, and operational follow-up. Coverage is generated from detection metadata and configured AI data-source selectors; live findings are limited to standard ESCU rule saved-search output in the form ESCU - - Rule. The mapping is practitioner-maintained operational guidance and is not an official NIST or Splunk taxonomy.", + "title": "NIST AI RMF Control Coverage" +} diff --git a/dashboards/nist_ai_rmf_control_coverage.yml b/dashboards/nist_ai_rmf_control_coverage.yml new file mode 100644 index 0000000000..14cd65d651 --- /dev/null +++ b/dashboards/nist_ai_rmf_control_coverage.yml @@ -0,0 +1,9 @@ +name: NIST AI RMF Control Coverage +id: 426d4e21-dace-4d38-b292-6cc49a376251 +version: 2 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Nasreddine Bencherchali, Rod Soto, Splunk +description: |- + Maps AI-related ESCU detections and ESCU-generated risk/notable findings to NIST AI RMF subcategories for coverage review, gap analysis, and operational follow-up. + Coverage is generated from detection metadata and configured AI data-source selectors; live findings are limited to standard ESCU rule saved-search output in the form "ESCU - - Rule". diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv new file mode 100644 index 0000000000..391d63fab3 --- /dev/null +++ b/lookups/csv/detection_subcategory_map.csv @@ -0,0 +1,33 @@ +ai_system,data_sources,detection_name,detection_status,detection_type,analytic_stories,rmf_function,subcategory_ids,mapping_confidence,mapping_source,mapping_reason +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Cross Region Possible Inference Abuse,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude excessive use of tokens,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE|MANAGE,Measure 2.7|Manage 4.1|Manage 4.3,high,generated_rule,AI security and resilience evaluation signal; Post-deployment monitoring and response signal; Incident tracking or response signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Hostile Prompt Sentiment,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6,high,generated_rule,Prompt-behavior and harmful-content measurement signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Possible Prompt Injection,production,Hunting,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Sensitive Data in Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Unusually Large Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Local LLM Frameworks,CrowdStrike ProcessRollup2|Sysmon EventID 1|Windows Event Log Security 4688,Windows Local LLM Framework Execution,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1|Map 4.2,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal; AI system operating context signal" +Local LLM Frameworks,Sysmon EventID 11,LLM Model File Creation,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal" +Local LLM Frameworks,Sysmon EventID 22,Local LLM Framework DNS Query,production,Hunting,Suspicious Local LLM Frameworks,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +M365 Copilot,M365 Copilot Graph API,M365 Copilot Application Usage Pattern Anomalies,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +M365 Copilot,M365 Copilot Graph API,M365 Copilot Failed Authentication Patterns,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +M365 Copilot,M365 Copilot Graph API,M365 Copilot Non Compliant Devices Accessing M365 Copilot,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,GOVERN,Govern 1.6,high,generated_rule,AI system or access inventory signal +M365 Copilot,M365 Copilot Graph API,M365 Copilot Session Origin Anomalies,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Agentic Jailbreak Attack,experimental,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Impersonation Jailbreak Attack,experimental,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Information Extraction Jailbreak Attack,experimental,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7|Measure 2.10,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal; Sensitive information or data-protection signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Jailbreak Attempts,experimental,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +MCP,MCP Server,MCP Filesystem Server Suspicious Extension Write,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal +MCP,MCP Server,MCP Github Suspicious Operation,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal +MCP,MCP Server,MCP Postgres Suspicious Query,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal +MCP,MCP Server,MCP Prompt Injection,production,TTP,Suspicious MCP Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +MCP,MCP Server,MCP Sensitive System File Search,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal +Ollama,Ollama Server,Ollama Abnormal Network Connectivity,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Abnormal Service Crash Availability Attack,experimental,Anomaly,Suspicious Ollama Activities,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Excessive API Requests,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Possible Model Exfiltration Data Leakage,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal +Ollama,Ollama Server,Ollama Possible RCE via Model Loading,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.7|Manage 4.3,high,generated_rule,AI security and resilience evaluation signal; Incident tracking or response signal +Ollama,Ollama Server,Ollama Suspicious Prompt Injection Jailbreak,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml new file mode 100644 index 0000000000..b98d706b65 --- /dev/null +++ b/lookups/csv/detection_subcategory_map.yml @@ -0,0 +1,8 @@ +name: detection_subcategory_map +id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 +version: 2 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team +lookup_type: csv +description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. Regenerate with scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py when AI data sources or detections change. diff --git a/lookups/csv/nist_ai_rmf_subcategories.csv b/lookups/csv/nist_ai_rmf_subcategories.csv new file mode 100644 index 0000000000..55c4da35de --- /dev/null +++ b/lookups/csv/nist_ai_rmf_subcategories.csv @@ -0,0 +1,73 @@ +"function","category_id","category_text","subcategory_id","subcategory_text" +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.1","Legal and regulatory requirements involving AI are understood, managed, and documented." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.2","The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.3","Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.4","The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.5","Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.6","Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.7","Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness." +"GOVERN","Govern 2","Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","Govern 2.1","Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization." +"GOVERN","Govern 2","Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","Govern 2.2","The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements." +"GOVERN","Govern 2","Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","Govern 2.3","Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment." +"GOVERN","Govern 3","Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.","Govern 3.1","Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds)." +"GOVERN","Govern 3","Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.","Govern 3.2","Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems." +"GOVERN","Govern 4","Organizational teams are committed to a culture that considers and communicates AI risk.","Govern 4.1","Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts." +"GOVERN","Govern 4","Organizational teams are committed to a culture that considers and communicates AI risk.","Govern 4.2","Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly." +"GOVERN","Govern 4","Organizational teams are committed to a culture that considers and communicates AI risk.","Govern 4.3","Organizational practices are in place to enable AI testing, identification of incidents, and information sharing." +"GOVERN","Govern 5","Processes are in place for robust engagement with relevant AI actors.","Govern 5.1","Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks." +"GOVERN","Govern 5","Processes are in place for robust engagement with relevant AI actors.","Govern 5.2","Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation." +"GOVERN","Govern 6","Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.","Govern 6.1","Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights." +"GOVERN","Govern 6","Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.","Govern 6.2","Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.1","A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.2","Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.3","Responses to the AI risks deemed high priority, as identified by the map function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.4","Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.1","Resources required to manage AI risks are taken into account - along with viable non-AI alternative systems, approaches, or methods - to reduce the magnitude or likelihood of potential impacts." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.2","Mechanisms are in place and applied to sustain the value of deployed AI systems." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.3","Procedures are followed to respond to and recover from a previously unknown risk when it is identified." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.4","Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use." +"MANAGE","Manage 3","AI risks and benefits from third-party entities are managed.","Manage 3.1","AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented." +"MANAGE","Manage 3","AI risks and benefits from third-party entities are managed.","Manage 3.2","Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance." +"MANAGE","Manage 4","Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","Manage 4.1","Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management." +"MANAGE","Manage 4","Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","Manage 4.2","Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors." +"MANAGE","Manage 4","Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","Manage 4.3","Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented." +"MAP","Map 1","Context is established and understood.","Map 1.1","Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented. Considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related TEVV and system metrics." +"MAP","Map 1","Context is established and understood.","Map 1.2","Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized." +"MAP","Map 1","Context is established and understood.","Map 1.3","The organization's mission and relevant goals for AI technology are understood and documented." +"MAP","Map 1","Context is established and understood.","Map 1.4","The business value or context of business use has been clearly defined or - in the case of assessing existing AI systems - re-evaluated." +"MAP","Map 1","Context is established and understood.","Map 1.5","Organizational risk tolerances are determined and documented." +"MAP","Map 1","Context is established and understood.","Map 1.6","System requirements (e.g., 'the system shall respect the privacy of its users') are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks." +"MAP","Map 2","Categorization of the AI system is performed.","Map 2.1","The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders)." +"MAP","Map 2","Categorization of the AI system is performed.","Map 2.2","Information about the AI system's knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions." +"MAP","Map 2","Categorization of the AI system is performed.","Map 2.3","Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.1","Potential benefits of intended AI system functionality and performance are examined and documented." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.2","Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness - as connected to organizational risk tolerance - are examined and documented." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.3","Targeted application scope is specified and documented based on the system's capability, established context, and AI system categorization." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.4","Processes for operator and practitioner proficiency with AI system performance and trustworthiness - and relevant technical standards and certifications - are defined, assessed, and documented." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.5","Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the govern function." +"MAP","Map 4","Risks and benefits are mapped for all components of the AI system including third-party software and data.","Map 4.1","Approaches for mapping AI technology and legal risks of its components - including the use of third-party data or software - are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights." +"MAP","Map 4","Risks and benefits are mapped for all components of the AI system including third-party software and data.","Map 4.2","Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented." +"MAP","Map 5","Impacts to individuals, groups, communities, organizations, and society are characterized.","Map 5.1","Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented." +"MAP","Map 5","Impacts to individuals, groups, communities, organizations, and society are characterized.","Map 5.2","Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented." +"MEASURE","Measure 1","Appropriate methods and metrics are identified and applied.","Measure 1.1","Approaches and metrics for measurement of AI risks enumerated during the map function are selected for implementation starting with the most significant AI risks. The risks or trustworthiness characteristics that will not - or cannot - be measured are properly documented." +"MEASURE","Measure 1","Appropriate methods and metrics are identified and applied.","Measure 1.2","Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities." +"MEASURE","Measure 1","Appropriate methods and metrics are identified and applied.","Measure 1.3","Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.1","Test sets, metrics, and details about the tools used during TEVV are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.10","Privacy risk of the AI system - as identified in the map function - is examined and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.11","Fairness and bias - as identified in the map function - are evaluated and results are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.12","Environmental impact and sustainability of AI model training and management activities - as identified in the map function - are assessed and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.13","Effectiveness of the employed TEVV metrics and processes in the measure function are evaluated and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.2","Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.3","AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). Measures are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.4","The functionality and behavior of the AI system and its components - as identified in the map function - are monitored when in production." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.5","The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.6","The AI system is evaluated regularly for safety risks - as identified in the map function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.7","AI system security and resilience - as identified in the map function - are evaluated and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.8","Risks associated with transparency and accountability - as identified in the map function - are examined and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.9","The AI model is explained, validated, and documented, and AI system output is interpreted within its context - as identified in the map function - to inform responsible use and governance." +"MEASURE","Measure 3","Mechanisms for tracking identified AI risks over time are in place.","Measure 3.1","Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts." +"MEASURE","Measure 3","Mechanisms for tracking identified AI risks over time are in place.","Measure 3.2","Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available." +"MEASURE","Measure 3","Mechanisms for tracking identified AI risks over time are in place.","Measure 3.3","Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics." +"MEASURE","Measure 4","Feedback about efficacy of measurement is gathered and assessed.","Measure 4.1","Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented." +"MEASURE","Measure 4","Feedback about efficacy of measurement is gathered and assessed.","Measure 4.2","Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. Results are documented." +"MEASURE","Measure 4","Feedback about efficacy of measurement is gathered and assessed.","Measure 4.3","Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context-relevant risks and trustworthiness characteristics are identified and documented." diff --git a/lookups/csv/nist_ai_rmf_subcategories.yml b/lookups/csv/nist_ai_rmf_subcategories.yml new file mode 100644 index 0000000000..2381c3c4ef --- /dev/null +++ b/lookups/csv/nist_ai_rmf_subcategories.yml @@ -0,0 +1,8 @@ +name: nist_ai_rmf_subcategories +id: ac42b14f-4f89-45c9-bc3d-728109b3b3b1 +version: 1 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team +lookup_type: csv +description: NIST AI RMF function, category, and subcategory reference data used by the NIST AI RMF Control Coverage dashboard. diff --git a/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py new file mode 100644 index 0000000000..9b651f28e6 --- /dev/null +++ b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py @@ -0,0 +1,404 @@ +#!/usr/bin/env python3 +"""Generate the NIST AI RMF detection-to-subcategory lookup from ESCU detections.""" + +from __future__ import annotations + +import argparse +import csv +import io +import re +import sys +from collections import defaultdict +from dataclasses import dataclass +from datetime import date +from pathlib import Path +from typing import Any + +import yaml + + +DEFAULT_CONFIG = Path("scripts/nist_dashboard/nist_ai_rmf_data_sources.yml") +DEFAULT_DETECTIONS_DIR = Path("detections") +DEFAULT_RMF_LOOKUP = Path("lookups/csv/nist_ai_rmf_subcategories.csv") +DEFAULT_OUTPUT = Path("lookups/csv/detection_subcategory_map.csv") +DEFAULT_METADATA = Path("lookups/csv/detection_subcategory_map.yml") + +FIELDNAMES = [ + "ai_system", + "data_sources", + "detection_name", + "detection_status", + "detection_type", + "analytic_stories", + "rmf_function", + "subcategory_ids", + "mapping_confidence", + "mapping_source", + "mapping_reason", +] + +FUNCTION_ORDER = { + "GOVERN": 1, + "MAP": 2, + "MEASURE": 3, + "MANAGE": 4, +} + + +@dataclass(frozen=True) +class DataSourceSelector: + name: str + ai_system: str + analytic_stories: tuple[str, ...] = () + + +@dataclass(frozen=True) +class MappingRule: + pattern: re.Pattern[str] + subcategory_ids: tuple[str, ...] + reason: str + confidence: str = "high" + + +RULES: tuple[MappingRule, ...] = ( + MappingRule( + re.compile(r"\b(non[- ]?compliant|unauthorized|unmanaged).*(device|ai|llm)|\b(local llm framework execution|model file creation)\b", re.I), + ("Govern 1.6",), + "AI system or access inventory signal", + ), + MappingRule( + re.compile(r"\b(local llm|framework dns|model file creation|network connectivity|api endpoint scan|reconnaissance|cross[- ]?region)\b", re.I), + ("Map 4.1",), + "AI component, model, or service discovery signal", + ), + MappingRule( + re.compile(r"\bwindows local llm framework execution\b", re.I), + ("Map 4.2",), + "AI system operating context signal", + ), + MappingRule( + re.compile(r"\b(unusually large|excessive.*tokens?|excessive.*api requests?|memory exhaustion|application usage pattern|session origin|behavior anomaly|failed authentication)\b", re.I), + ("Measure 2.4",), + "Production behavior monitoring signal", + ), + MappingRule( + re.compile(r"\b(prompt injection|jailbreak|ignore previous|system prompt override|hostile prompt|sentiment)\b", re.I), + ("Measure 2.6",), + "Prompt-behavior and harmful-content measurement signal", + ), + MappingRule( + re.compile(r"\b(prompt injection|jailbreak|agentic|impersonation|rce|remote code|model loading|suspicious extension write|github suspicious|postgres suspicious|tool invocation)\b", re.I), + ("Measure 2.7",), + "AI security and resilience evaluation signal", + ), + MappingRule( + re.compile(r"\b(sensitive data|credential|secret|api key|information extraction|system file|model exfiltration|data leakage|/etc/passwd|\.aws/credentials)\b", re.I), + ("Measure 2.10",), + "Sensitive information or data-protection signal", + ), + MappingRule( + re.compile(r"\b(failed authentication|service crash|availability|memory exhaustion|excessive.*api requests?|security alerts?|critical alerts?|high risk filesystem|exec tool|delete guardrail|delete knowledge base|delete model invocation logging)\b", re.I), + ("Manage 4.1",), + "Post-deployment monitoring and response signal", + ), + MappingRule( + re.compile(r"\b(high risk filesystem|exec tool|rce|remote code|incident|delete guardrail|delete knowledge base|delete model invocation logging)\b", re.I), + ("Manage 4.3",), + "Incident tracking or response signal", + ), +) + + +def parse_args() -> argparse.Namespace: + parser = argparse.ArgumentParser( + description=( + "Generate lookups/csv/detection_subcategory_map.csv from ESCU detection " + "metadata and a configured list of AI-related data sources." + ) + ) + parser.add_argument("--config", type=Path, default=DEFAULT_CONFIG, help=f"Data source config. Default: {DEFAULT_CONFIG}") + parser.add_argument( + "--data-source", + action="append", + default=[], + help="Additional data source name to include. The AI system defaults to the data source name.", + ) + parser.add_argument("--detections-dir", type=Path, default=DEFAULT_DETECTIONS_DIR, help=f"Detections directory. Default: {DEFAULT_DETECTIONS_DIR}") + parser.add_argument("--rmf-lookup", type=Path, default=DEFAULT_RMF_LOOKUP, help=f"NIST AI RMF subcategory lookup. Default: {DEFAULT_RMF_LOOKUP}") + parser.add_argument("--output", type=Path, default=DEFAULT_OUTPUT, help=f"CSV output path. Default: {DEFAULT_OUTPUT}") + parser.add_argument("--metadata", type=Path, default=DEFAULT_METADATA, help=f"Lookup metadata YAML to bump when --output changes. Default: {DEFAULT_METADATA}") + parser.add_argument("--modified-date", default=None, help="Metadata modification date in YYYY-MM-DD format. Default: today.") + parser.add_argument("--no-metadata-update", action="store_true", help="Do not bump lookup metadata when --output changes.") + parser.add_argument("--include-deprecated", action="store_true", help="Include detections under detections/deprecated and detections with deprecated status.") + parser.add_argument("--dry-run", action="store_true", help="Write generated CSV to stdout instead of --output.") + return parser.parse_args() + + +def as_list(value: Any) -> list[str]: + if value is None: + return [] + if isinstance(value, list): + return [str(item).strip() for item in value if str(item).strip()] + text = str(value).strip() + return [text] if text else [] + + +def norm(value: str) -> str: + return re.sub(r"\s+", " ", value.strip()).casefold() + + +def load_yaml(path: Path) -> dict[str, Any]: + with path.open(encoding="utf-8") as handle: + loaded = yaml.safe_load(handle) or {} + if not isinstance(loaded, dict): + raise ValueError(f"{path} must contain a YAML mapping") + return loaded + + +def load_selectors(config_path: Path, cli_data_sources: list[str]) -> list[DataSourceSelector]: + selectors: list[DataSourceSelector] = [] + + if config_path.exists(): + config = load_yaml(config_path) + configured_sources = config.get("data_sources", []) + if not isinstance(configured_sources, list): + raise ValueError(f"{config_path}: data_sources must be a list") + for item in configured_sources: + if isinstance(item, str): + selectors.append(DataSourceSelector(name=item, ai_system=item)) + continue + if not isinstance(item, dict): + raise ValueError(f"{config_path}: each data_sources entry must be a string or mapping") + name = str(item.get("name", "")).strip() + if not name: + raise ValueError(f"{config_path}: data source entry is missing name") + ai_system = str(item.get("ai_system") or name).strip() + stories = tuple(as_list(item.get("analytic_stories") or item.get("analytic_story"))) + selectors.append(DataSourceSelector(name=name, ai_system=ai_system, analytic_stories=stories)) + + for data_source in cli_data_sources: + data_source = data_source.strip() + if data_source: + selectors.append(DataSourceSelector(name=data_source, ai_system=data_source)) + + if not selectors: + raise ValueError("No data sources configured. Add --data-source or provide a config file.") + + deduped: dict[tuple[str, str, tuple[str, ...]], DataSourceSelector] = {} + for selector in selectors: + deduped[(norm(selector.name), norm(selector.ai_system), tuple(norm(s) for s in selector.analytic_stories))] = selector + return list(deduped.values()) + + +def load_valid_subcategories(path: Path) -> dict[str, str]: + valid: dict[str, str] = {} + with path.open(newline="", encoding="utf-8-sig") as handle: + reader = csv.DictReader(handle) + required = {"function", "subcategory_id"} + missing = required - set(reader.fieldnames or []) + if missing: + raise ValueError(f"{path} is missing required columns: {', '.join(sorted(missing))}") + for row in reader: + subcategory_id = (row.get("subcategory_id") or "").strip() + function = (row.get("function") or "").strip().upper() + if subcategory_id: + valid[subcategory_id] = function + if not valid: + raise ValueError(f"{path} did not contain any subcategory IDs") + return valid + + +def detection_files(root: Path, include_deprecated: bool) -> list[Path]: + files = sorted(root.rglob("*.yml")) + if include_deprecated: + return files + return [path for path in files if "deprecated" not in {part.casefold() for part in path.parts}] + + +def selector_matches(selector: DataSourceSelector, detection_data_sources: set[str], detection_stories: set[str]) -> bool: + if norm(selector.name) not in detection_data_sources: + return False + if selector.analytic_stories and not ({norm(story) for story in selector.analytic_stories} & detection_stories): + return False + return True + + +def confidence_rank(confidence: str) -> int: + return {"review": 1, "medium": 2, "high": 3}.get(confidence, 1) + + +def derive_mapping(detection: dict[str, Any], valid_subcategories: dict[str, str]) -> tuple[list[str], str, str, str]: + context_fields = [ + detection.get("name"), + detection.get("type"), + detection.get("status"), + " ".join(as_list(detection.get("data_source"))), + " ".join(as_list(detection.get("analytic_story"))), + ] + context = " ".join(str(field) for field in context_fields if field) + + subcategory_ids: list[str] = [] + reasons: list[str] = [] + confidence = "review" + for rule in RULES: + if rule.pattern.search(context): + for subcategory_id in rule.subcategory_ids: + if subcategory_id not in subcategory_ids: + subcategory_ids.append(subcategory_id) + if rule.reason not in reasons: + reasons.append(rule.reason) + if confidence_rank(rule.confidence) > confidence_rank(confidence): + confidence = rule.confidence + + if not subcategory_ids: + subcategory_ids = ["Measure 2.4"] + confidence = "review" + reasons = ["AI data source matched, but no specific RMF rule matched"] + + invalid = [subcategory_id for subcategory_id in subcategory_ids if subcategory_id not in valid_subcategories] + if invalid: + raise ValueError(f"{detection.get('name', '')} mapped to unknown RMF subcategories: {', '.join(invalid)}") + + functions = sorted( + {valid_subcategories[subcategory_id] for subcategory_id in subcategory_ids}, + key=lambda item: FUNCTION_ORDER.get(item, 99), + ) + mapping_source = "generated_rule" if confidence != "review" else "generated_review" + return subcategory_ids, "|".join(functions), confidence, "; ".join(reasons) + + +def rows_from_detections( + detections_dir: Path, + selectors: list[DataSourceSelector], + valid_subcategories: dict[str, str], + include_deprecated: bool, +) -> list[dict[str, str]]: + rows_by_key: dict[tuple[str, str], dict[str, str]] = {} + data_sources_by_key: dict[tuple[str, str], set[str]] = defaultdict(set) + + for path in detection_files(detections_dir, include_deprecated): + detection = load_yaml(path) + name = str(detection.get("name", "")).strip() + if not name: + continue + + status = str(detection.get("status", "")).strip() + if not include_deprecated and status.casefold() == "deprecated": + continue + + data_source_values = as_list(detection.get("data_source")) + story_values = as_list(detection.get("analytic_story")) + detection_data_sources = {norm(value) for value in data_source_values} + detection_stories = {norm(value) for value in story_values} + + matched_by_ai_system: dict[str, set[str]] = defaultdict(set) + for selector in selectors: + if selector_matches(selector, detection_data_sources, detection_stories): + matched_by_ai_system[selector.ai_system].add(selector.name) + + if not matched_by_ai_system: + continue + + subcategory_ids, rmf_function, confidence, reason = derive_mapping(detection, valid_subcategories) + for ai_system, matched_sources in matched_by_ai_system.items(): + key = (ai_system, name) + data_sources_by_key[key].update(matched_sources) + rows_by_key[key] = { + "ai_system": ai_system, + "data_sources": "", + "detection_name": name, + "detection_status": status, + "detection_type": str(detection.get("type", "")).strip(), + "analytic_stories": "|".join(story_values), + "rmf_function": rmf_function, + "subcategory_ids": "|".join(subcategory_ids), + "mapping_confidence": confidence, + "mapping_source": "generated_rule" if confidence != "review" else "generated_review", + "mapping_reason": reason, + } + + rows = list(rows_by_key.values()) + for row in rows: + key = (row["ai_system"], row["detection_name"]) + row["data_sources"] = "|".join(sorted(data_sources_by_key[key], key=str.casefold)) + rows.sort(key=lambda row: (row["ai_system"].casefold(), row["data_sources"].casefold(), row["detection_name"].casefold())) + return rows + + +def render_csv(rows: list[dict[str, str]]) -> str: + output = io.StringIO() + writer = csv.DictWriter(output, fieldnames=FIELDNAMES, lineterminator="\n") + writer.writeheader() + writer.writerows(rows) + return output.getvalue() + + +def write_csv_if_changed(content: str, output: Path | None) -> bool: + if output is None: + sys.stdout.write(content) + return True + + output.parent.mkdir(parents=True, exist_ok=True) + if output.exists() and output.read_text(encoding="utf-8") == content: + return False + + with output.open("w", newline="", encoding="utf-8") as handle: + handle.write(content) + return True + + +def validate_modified_date(value: str | None) -> str: + if value is None: + return date.today().isoformat() + if not re.fullmatch(r"\d{4}-\d{2}-\d{2}", value): + raise ValueError("--modified-date must use YYYY-MM-DD format") + return value + + +def bump_lookup_metadata(path: Path, modification_date: str) -> int: + metadata = load_yaml(path) + try: + version = int(metadata.get("version", 0)) + except (TypeError, ValueError) as exc: + raise ValueError(f"{path}: version must be an integer") from exc + + metadata["version"] = version + 1 + metadata["modification_date"] = modification_date + + with path.open("w", encoding="utf-8", newline="\n") as handle: + yaml.safe_dump(metadata, handle, sort_keys=False, width=120) + return metadata["version"] + + +def main() -> int: + args = parse_args() + selectors = load_selectors(args.config, args.data_source) + valid_subcategories = load_valid_subcategories(args.rmf_lookup) + rows = rows_from_detections(args.detections_dir, selectors, valid_subcategories, args.include_deprecated) + + if not rows: + raise ValueError("No detection mappings were generated. Check the configured data source names.") + + csv_content = render_csv(rows) + output_changed = write_csv_if_changed(csv_content, None if args.dry_run else args.output) + + message = f"Generated {len(rows)} detection mappings from {len(selectors)} data source selectors." + if not args.dry_run: + if output_changed and not args.no_metadata_update: + new_version = bump_lookup_metadata(args.metadata, validate_modified_date(args.modified_date)) + message += f" {args.metadata} bumped to version {new_version}." + elif output_changed: + message += " Output changed; metadata update skipped." + else: + message += " Output unchanged." + + print(message, file=sys.stderr) + return 0 + + +if __name__ == "__main__": + try: + raise SystemExit(main()) + except Exception as exc: + print(f"error: {exc}", file=sys.stderr) + raise SystemExit(1) diff --git a/scripts/nist_dashboard/nist_ai_rmf_data_sources.yml b/scripts/nist_dashboard/nist_ai_rmf_data_sources.yml new file mode 100644 index 0000000000..d20b0d09ce --- /dev/null +++ b/scripts/nist_dashboard/nist_ai_rmf_data_sources.yml @@ -0,0 +1,43 @@ +data_sources: + - name: AWS Bedrock Claude + ai_system: AWS Bedrock Claude + + - name: M365 Exported eDiscovery Prompts + ai_system: M365 Copilot + + - name: M365 Copilot Graph API + ai_system: M365 Copilot + + - name: MCP Server + ai_system: MCP + + - name: Ollama Server + ai_system: Ollama + + - name: Cisco AI Defense Alerts + ai_system: Cisco AI Defense + + - name: Sysmon EventID 11 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: Sysmon EventID 22 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: Sysmon EventID 1 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: Windows Event Log Security 4688 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: CrowdStrike ProcessRollup2 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks From 9b137cefd950f7c04f9cb1affc7b71a7e79c93dd Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 4 Sep 2026 16:29:11 +0200 Subject: [PATCH 093/164] Content Updates & Fixes - Batch 6.6 (#4251) --- .../lolbas_with_network_traffic.yml | 12 +- ...ile_download_or_read_to_pipe_execution.yml | 12 +- detections/endpoint/icacls_deny_command.yml | 55 +++--- .../linux_data_destruction_command.yml | 60 ++++--- .../linux_ghostscript_exploitation.yml | 6 +- ...as_network_connection_on_uncommon_port.yml | 166 ++++++++++++++++++ .../lolbas_rare_network_connection.yml | 144 +++++++++++++++ detections/endpoint/macos_account_created.yml | 6 +- detections/endpoint/macos_data_chunking.yml | 6 +- .../endpoint/powershell_4104_hunting.yml | 139 +++++++++++---- .../endpoint/suspicious_wevtutil_usage.yml | 70 ++++++-- .../windows_process_execution_in_temp_dir.yml | 6 +- .../windows_suspicious_process_file_path.yml | 6 +- .../windows_tinycc_shellcode_execution.yml | 50 +++--- ...swow64_process_run_system32_executable.yml | 6 +- .../citrix_adc_exploitation_cve_2023_3519.yml | 18 +- removed/stories/lateral_movement.yml | 6 +- 17 files changed, 617 insertions(+), 151 deletions(-) rename detections/{endpoint => deprecated}/lolbas_with_network_traffic.yml (92%) create mode 100644 detections/endpoint/lolbas_network_connection_on_uncommon_port.yml create mode 100644 detections/endpoint/lolbas_rare_network_connection.yml diff --git a/detections/endpoint/lolbas_with_network_traffic.yml b/detections/deprecated/lolbas_with_network_traffic.yml similarity index 92% rename from detections/endpoint/lolbas_with_network_traffic.yml rename to detections/deprecated/lolbas_with_network_traffic.yml index 21fafb429e..0910406a7c 100644 --- a/detections/endpoint/lolbas_with_network_traffic.yml +++ b/detections/deprecated/lolbas_with_network_traffic.yml @@ -1,10 +1,10 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 -version: 18 +version: 19 creation_date: '2023-02-02' -modification_date: '2026-05-13' +modification_date: '2026-08-24' author: Steven Dick -status: production +status: deprecated type: TTP description: The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently used to download malicious payloads, enabling lateral movement, command-and-control, or data exfiltration. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security. data_source: @@ -144,3 +144,9 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to high false positive rates from certain LOLBAS binaries with common legitimate network behavior. This broad analytic is being split into more manageable anomaly analytics with separate process groups and common-port tuning. + removed_in_version: 6.8.0 + replacement_content: + - LOLBAS Rare Network Connection + - LOLBAS Network Connection On Uncommon Port diff --git a/detections/endpoint/file_download_or_read_to_pipe_execution.yml b/detections/endpoint/file_download_or_read_to_pipe_execution.yml index 7afb873800..df3d8bb192 100644 --- a/detections/endpoint/file_download_or_read_to_pipe_execution.yml +++ b/detections/endpoint/file_download_or_read_to_pipe_execution.yml @@ -1,8 +1,8 @@ name: File Download or Read to Pipe Execution id: 26f86252-1549-45e1-a212-eb26840e86bc -version: 5 +version: 6 creation_date: '2025-10-24' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Michael Haag, Nasreddine Bencherchali, Splunk, DipsyTipsy status: production type: TTP @@ -56,7 +56,7 @@ search: | OR ``` Because the "sh" string can overlap and is a short atom we treat it in a special case ``` Processes.process IN ( - "*|sh" + "*|sh*" "* sh*" ) OR @@ -103,7 +103,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: An instance of $process_name$ was identified on endpoint $dest$ attempting to immediately read or download a file and run it via a shell. + title: An instance of [$process_name$] was identified on endpoint [$dest$] attempting to immediately read or download a file and run it via a shell via the CommandLine [$process$] via the ParentProcess [$parent_process$]. entity: field: user type: user @@ -113,10 +113,10 @@ intermediate_findings: - field: dest type: system score: 50 - message: An instance of $process_name$ was identified on endpoint $dest$ attempting to immediately read or download a file and run it via a shell. + message: An instance of [$process_name$] was identified on endpoint [$dest$] attempting to immediately read or download a file and run it via a shell via the CommandLine [$process$] via the ParentProcess [$parent_process$]. threat_objects: - field: process - type: process_name + type: process - field: process_name type: process_name analytic_story: diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index b4a97dd8d0..034bbb883c 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -1,34 +1,47 @@ name: Icacls Deny Command id: cf8d753e-a8fe-11eb-8f58-acde48001122 -version: 14 +version: 15 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: Anomaly description: | - The following analytic detects instances where an adversary modifies - security permissions of a file or directory using commands like "icacls.exe", "cacls.exe", - or "xcacls.exe" with deny options. It leverages data from Endpoint Detection and - Response (EDR) agents, focusing on process names and command-line executions. This - activity is significant as it is commonly used by Advanced Persistent Threats (APTs) - and coinminer scripts to evade detection and impede access to critical files. If - confirmed malicious, this could allow attackers to maintain persistence and hinder - incident response efforts. + The following analytic detects instances where an adversary modifies security permissions of a file or directory using commands like "icacls.exe", "cacls.exe", or "xcacls.exe" with deny options. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. + This activity is significant as it is commonly used by Advanced Persistent Threats (APTs) and coinminer scripts to evade detection and impede access to critical files. + If confirmed malicious, this could allow attackers to maintain persistence and hinder incident response efforts. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where - Processes.process_name IN ( "icacls.exe", "cacls.exe", "xcacls.exe") AND - Processes.process IN ("*/deny*", "*/d:*", "*/d ") - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + From datamodel=Endpoint.Processes Where + + Processes.process_name IN ( + "icacls.exe", + "cacls.exe", + "xcacls.exe" + ) + Processes.process IN ( + "*/deny*", + "*/d:*", + "*/d *" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -60,11 +73,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ + message: Process name [$process_name$] with deny argument executed by [$user$] to change security permission of a specific file or directory on host [$dest$]. - field: user type: user score: 20 - message: Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ + message: Process name [$process_name$] with deny argument executed by [$user$] to change security permission of a specific file or directory on host [$dest$]. analytic_story: - Azorult - Sandworm Tools diff --git a/detections/endpoint/linux_data_destruction_command.yml b/detections/endpoint/linux_data_destruction_command.yml index da89fb867b..ba11f557e1 100644 --- a/detections/endpoint/linux_data_destruction_command.yml +++ b/detections/endpoint/linux_data_destruction_command.yml @@ -1,32 +1,48 @@ name: Linux Data Destruction Command id: b11d3979-b2f7-411b-bb1a-bd00e642173b -version: 12 +version: 13 creation_date: '2023-02-08' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' option. This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage. +type: Anomaly +description: |- + The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option. + This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. + If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. + Immediate investigation and response are crucial to mitigate potential damage. data_source: - Sysmon for Linux EventID 1 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name = "rm" - AND - Processes.process IN ("* -rf*", "* -fr*") - AND - Processes.process = "* --no-preserve-root" - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name = "rm" + Processes.process = "* --no-preserve-root*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_data_destruction_command_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. + To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: No false positives have been identified at this time. references: - https://cert.gov.ua/article/3718487 @@ -40,18 +56,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: a $process_name$ execute rm command with --no-preserve-root parmeter that can wipe root files on $dest$ - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system score: 50 - message: a $process_name$ execute rm command with --no-preserve-root parmeter that can wipe root files on $dest$ + message: The process [$process_name$] was executed with the command [$process$] that allows for the removal of files from the root directory on [$dest$]. analytic_story: - AwfulShred - Data Destruction diff --git a/detections/endpoint/linux_ghostscript_exploitation.yml b/detections/endpoint/linux_ghostscript_exploitation.yml index 39c1533e18..a3c7d72929 100644 --- a/detections/endpoint/linux_ghostscript_exploitation.yml +++ b/detections/endpoint/linux_ghostscript_exploitation.yml @@ -1,8 +1,8 @@ name: Linux Ghostscript Exploitation id: 580f99d8-a4c8-4ef1-9c84-f355867bca41 -version: 1 +version: 2 creation_date: '2026-07-08' -modification_date: '2026-07-08' +modification_date: '2026-09-01' author: Raven Tait, Splunk status: production type: TTP @@ -22,7 +22,7 @@ search: |- "*/gs", "*/ghostscript" ) - Processes.process="sh -c*" + Processes.process="*sh -c*" by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash Processes.parent_process_name diff --git a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml new file mode 100644 index 0000000000..bba241d4c1 --- /dev/null +++ b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml @@ -0,0 +1,166 @@ +name: LOLBAS Network Connection On Uncommon Port +id: a6628e6d-be28-4278-b17d-6b5a32968eea +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Steven Dick, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: | + The following analytic identifies Living Off the Land Binaries and Scripts (LOLBAS) that can legitimately initiate public network connections but are communicating over uncommon destination ports. + It leverages the Network Traffic data model and applies per-binary common-port exclusions to reduce false positives while preserving suspicious non-standard communication. + This behavior may indicate payload download, command-and-control, proxy execution, or attempts to blend malicious traffic into trusted Windows binaries. + Join this detection with the Process Execution events to provide context and avoid false positives. +data_source: + - Sysmon EventID 3 +search: | + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Network_Traffic.All_Traffic where + + All_Traffic.app IN ( + "*\\bitsadmin.exe", + "*\\certutil.exe", + "*\\cmstp.exe", + "*\\cscript.exe", + "*\\ftp.exe", + "*\\hh.exe", + "*\\ie4uinit.exe", + "*\\ieexec.exe", + "*\\msbuild.exe", + "*\\msdt.exe", + "*\\mshta.exe", + "*\\msiexec.exe", + "*\\presentationhost.exe", + "*\\settingsynchost.exe", + "*\\syncappvpublishingserver.exe", + "*\\workfolders.exe", + "*\\wscript.exe", + "*\\wuauclt.exe" + ) + + NOT All_Traffic.dest_ip IN ( + "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", + "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", + "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", + "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", + "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", + "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", + "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", + "203.0.113.0/24", "240.0.0.0/4" + ) + + NOT ( + ( + All_Traffic.app IN ( + "*\\cscript.exe", + "*\\wscript.exe" + ) + All_Traffic.dest_port IN ("80", "443", "3128") + ) + OR + ( + All_Traffic.app="*\\ftp.exe" + All_Traffic.dest_port IN ("20", "21", "989", "990") + ) + OR + ( + All_Traffic.app IN ( + "*\\bitsadmin.exe", + "*\\certutil.exe", + "*\\cmstp.exe", + "*\\hh.exe", + "*\\ieexec.exe", + "*\\msbuild.exe", + "*\\msdt.exe", + "*\\mshta.exe", + "*\\msiexec.exe", + "*\\presentationhost.exe", + "*\\settingsynchost.exe", + "*\\syncappvpublishingserver.exe", + "*\\workfolders.exe", + "*\\wuauclt.exe" + ) + All_Traffic.dest_port IN ("80", "443") + ) + OR + ( + All_Traffic.app IN ( + "*\\certutil.exe", + "*\\ie4uinit.exe" + ) + All_Traffic.dest_port IN ("389") + ) + ) + + by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port + All_Traffic.direction All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src + All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user + All_Traffic.vendor_product + + | `drop_dm_object_name(All_Traffic)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `lolbas_network_connection_on_uncommon_port_filter` +how_to_implement: |- + To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field. + Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model. +known_false_positives: |- + Legitimate software installation, support tooling, scripting, synchronization, or update workflows may still use uncommon ports in some environments. + Tune approved destinations, ports, and process paths with the analytic filter macro. +references: + - https://lolbas-project.github.io/# + - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: LOLBAS process [$app$] on [$src$] connected to public destination [$dest_ip$] over uncommon port [$dest_port$]. +threat_objects: + - field: app + type: process_name + - field: dest_ip + type: ip_address +analytic_story: + - Fake CAPTCHA Campaigns + - Living Off The Land + - Malicious Inno Setup Loader + - Water Gamayun + - APT37 Rustonotto and FadeStealer + - GhostRedirector IIS Module and Rungan Backdoor + - Hellcat Ransomware + - NetSupport RMM Tool Abuse +asset_type: Endpoint +mitre_attack_id: + - T1105 + - T1567 + - T1218 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: network +tests: + - name: Common Port Suppression Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + expected_results: 0 + test_type: unit diff --git a/detections/endpoint/lolbas_rare_network_connection.yml b/detections/endpoint/lolbas_rare_network_connection.yml new file mode 100644 index 0000000000..f6bc5c3655 --- /dev/null +++ b/detections/endpoint/lolbas_rare_network_connection.yml @@ -0,0 +1,144 @@ +name: LOLBAS Rare Network Connection +id: d09b66cc-269b-4675-81b5-a3dabe4f5ac2 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Steven Dick, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: | + The following analytic identifies public network connections initiated by Living Off the Land Binaries and Scripts (LOLBAS) that rarely require direct outbound network access. + It leverages the Network Traffic data model and focuses on native Windows binaries where any public destination should be investigated and explicitly approved. + This activity may indicate proxy execution, process injection, payload download, command-and-control, or other abuse of trusted binaries to evade security controls. + Keep in mind that some of these binaries, such as Netsh.exe, Gpscript.exe, Wmic.exe, etc., will occasionally communicate with public network resources to perform their intended function. + Exclude said processes from the detection if they are too noisy for your environment. + Join this detection with the Process Execution events to provide context and avoid false positives. +data_source: + - Sysmon EventID 3 +search: | + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Network_Traffic.All_Traffic where + + All_Traffic.app IN ( + "*\\at.exe", + "*\\atbroker.exe", + "*\\certoc.exe", + "*\\diskshadow.exe", + "*\\dnscmd.exe", + "*\\extexport.exe", + "*\\forfiles.exe", + "*\\gpscript.exe", + "*\\infdefaultinstall.exe", + "*\\installutil.exe", + "*\\makecab.exe", + "*\\mavinject.exe", + "*\\microsoft.workflow.compiler.exe", + "*\\msconfig.exe", + "*\\netsh.exe", + "*\\notepad.exe", + "*\\odbcconf.exe", + "*\\offlinescannershell.exe", + "*\\pcalua.exe", + "*\\pcwrun.exe", + "*\\pnputil.exe", + "*\\rasautou.exe", + "*\\regasm.exe", + "*\\register-cimprovider.exe", + "*\\regsvcs.exe", + "*\\regsvr32.exe", + "*\\runonce.exe", + "*\\runscripthelper.exe", + "*\\schtasks.exe", + "*\\scriptrunner.exe", + "*\\stordiag.exe", + "*\\ttdinject.exe", + "*\\tttracer.exe", + "*\\verclsid.exe", + "*\\wab.exe", + "*\\wmic.exe", + "*\\xwizard.exe" + ) + + NOT All_Traffic.dest_ip IN ( + "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", + "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", + "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", + "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", + "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", + "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", + "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", + "203.0.113.0/24", "240.0.0.0/4" + ) + + by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port + All_Traffic.direction All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src + All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user + All_Traffic.vendor_product + + | `drop_dm_object_name(All_Traffic)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `lolbas_rare_network_connection_filter` +how_to_implement: |- + To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field. Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model. +known_false_positives: |- + Limited legitimate administrative automation and scripts may cause false positives. + Any recurring use of these binaries for public network access should be reviewed, approved, and filtered with the analytic filter macro. + Notepad.exe can now communicate with Microsoft's service "apsaiservices.microsoft.com" over port 443 to provide AI services. Apply filtering if this behavior is known in your environment. + PowerShell, PowerShell ISE, PowerShell 7 (pwsh.exe), and cmd.exe are intentionally excluded from this analytic because they are too noisy. +references: + - https://lolbas-project.github.io/# + - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A rare public network connection from LOLBAS process [$app$] was observed on [$src$] to [$dest_ip$] over port [$dest_port$]. +threat_objects: + - field: app + type: process_name + - field: dest_ip + type: ip_address +analytic_story: + - Fake CAPTCHA Campaigns + - Living Off The Land + - Malicious Inno Setup Loader + - Water Gamayun + - APT37 Rustonotto and FadeStealer + - GhostRedirector IIS Module and Rungan Backdoor + - Hellcat Ransomware + - NetSupport RMM Tool Abuse +asset_type: Endpoint +mitre_attack_id: + - T1105 + - T1567 + - T1218 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/macos_account_created.yml b/detections/endpoint/macos_account_created.yml index 64f46cb85e..80b1f4b056 100644 --- a/detections/endpoint/macos_account_created.yml +++ b/detections/endpoint/macos_account_created.yml @@ -1,8 +1,8 @@ name: MacOS Account Created id: 491004ae-694f-453e-b1e0-fc1e65daeea1 -version: 3 +version: 4 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Raven Tait, Splunk status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- from datamodel=Endpoint.Processes where ( - Processes.process = "*sysadminctl" + Processes.process = "*sysadminctl*" Processes.process = "*-addUser*" ) OR diff --git a/detections/endpoint/macos_data_chunking.yml b/detections/endpoint/macos_data_chunking.yml index d3d5acda77..4fb29f1382 100644 --- a/detections/endpoint/macos_data_chunking.yml +++ b/detections/endpoint/macos_data_chunking.yml @@ -1,8 +1,8 @@ name: MacOS Data Chunking id: 7f1c8bed-9bd4-40b0-a1df-c262cbade0fc -version: 3 +version: 4 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Raven Tait, Splunk status: production type: Anomaly @@ -20,7 +20,7 @@ search: |- from datamodel=Endpoint.Processes where ( - Processes.process = "dd *" + Processes.process IN ("*/dd *", "dd *") Processes.process = "* if=*" ) OR diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index d8fb84f944..b52db6e54f 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,8 +1,8 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 28 +version: 29 creation_date: '2021-08-19' -modification_date: '2026-07-20' +modification_date: '2026-09-03' author: Michael Haag, Splunk status: production type: Hunting @@ -14,36 +14,109 @@ data_source: search: |- `powershell` EventCode=4104 - | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0) - | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) - | eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) - | eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0) - | eval empire=if(match(lower(ScriptBlockText),"system.net.webclient") AND match(lower(ScriptBlockText), "frombase64string") ,5,0) - | eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz") OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden") ,5,0) - | eval iex=if(match(ScriptBlockText, "(?i)iex|invoke-expression"),2,0) - | eval webclient=if(match(lower(ScriptBlockText),"http") OR match(lower(ScriptBlockText),"web(client|request)") OR match(lower(ScriptBlockText),"socket") OR match(lower(ScriptBlockText),"download(file|string)") OR match(lower(ScriptBlockText),"bitstransfer") OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0) - | eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0) - | eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"), "4", 0) - | eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0) - | eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0) - | eval httplocal = if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0) - | eval reflection = if(match(lower(ScriptBlockText),"reflection"), "1", 0) - | eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0) - | eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell -version"),3,0) - | eval compressed=if(match(ScriptBlockText, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0) - | eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) - | addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get - | stats values(Score) - BY UserID, Computer, DoIt, - enccom, compressed, downgrade, - iex, mimikatz, rundll32, - empire, webclient, syswow64, - httplocal, reflection, invokewmi, - invokecmd, base64, get, - suspcmdlet, suspkeywrd - | rename Computer as dest, UserID as user - | `powershell_4104_hunting_filter` -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. + + ScriptBlockText IN ( + "*-dumpcr%*", "*::decompress*", "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", + "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*", + "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*", + "*CachedRDPConnection*", "*Check-VM*", "*cnvert*", "*compress-archive*", "*ComputerProperty*", + "*comsvcs*", "*copy-vss*", "*CreateShortcut*", "*disablerealtimemonitoring*", + "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*", + "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*", + "*Find-*", "*Frombase64_keyword*", "*Get-ApplicationHost*", "*Get-ChromeDump*", + "*Get-ClipboardContents*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", + "*Get-Keystrokes*", "*Get-PassHash*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", + "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*", + "*Get-ServicePermission*", "*Get-ServiceUnquoted*", "*Get-SiteListPassword*", + "*Get-System*", "*Get-TimedScreenshot*", "*Get-UnattendedInstallFile*", + "*Get-Unconstrained*", "*Get-VaultCredential*", "*Get-VulnAutoRun*", + "*Get-VulnSchTask*", "*Gupt-Backdoor*", "*gzipstream*", "*hijack*", + "*HTTP-Login*", "*IEX *", "*injection*", "*Install-Service*", + "*Install-ServiceBinary*", "*Install-SSP*", "*internetexplorer.application*", + "*Invoke-*", "*io.compression*", "*kerberos::*", "*lastloggedon*", + "*localadmin*", "*LSASecret*", "*lsass.exe*", "*MailRaider*", "*metasp*", + "*mimikatz*", "*NEEEEWWW*", "*netfirewall*", "*NetworkRelay*", + "*New-HoneyHash*", "*ngrok*", "*nishang*", "*Out-Minidump*", + "*out-shortcut*", "*Port-Scan*", "*PortScan*", "*PowerBreach*", + "*PowerShellIcmp*", "*PowerShelludp*", "*powershellwmi*", "*PowerUp*", "*PowerView*", + "*rc4bytestream*", "*reflection.assembly*", "*remoteps*", "*remotewmi*", + "*Remove-Update*", "*SEKURLSA::*", "*Set-MacAttribute*", "*Set-Wallpaper*", + "*shell.application*", "*shellcode*", "*Show-TargetScreen*", "*Start-CaptureServer*", + "*start-process*", "*system.security.cryptography*", "*Uninstall-Windows*", "*UserProperty*", + "*VolumeShadowCopyTools*", "*WebClient*", "*webrequest*", "*wmicommand*", + "*wmimethod*", "*wmiobject*", "*write-zip*", "*xmlhttp*", + ) + + | eval script_lower=lower(ScriptBlockText) + + | eval ecnoded_command_keyword=if(match(ScriptBlockText,"(?i)(?:^|\\s)(?:/(?!/)|--?|–{1,2}|—{1,2}|―{1,2})(?:ec|encodedcommand|encodedcomman|encodedcomma|encodedcomm|encodedcom|encodedco|encodedc|encoded|encode|encod|enco|enc|en|e(?=\\s))\\s+['\\\"]?[A-Za-z0-9+/=]{5,}['\\\"]?"), 4, 0) + + | eval suspicious_cmdlets=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|netfirewall|Uninstall-Windows|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) + + | eval base64_keyword=if(like(script_lower,"%frombase64_keyword%"), 4, 0) + + | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%frombase64_keywordstring%"),5,0) + + | eval mimikatz=if(like(script_lower,"%mimikatz%") OR like(script_lower,"%-dumpcr%") OR like(script_lower,"%sekurlsa::pth%") OR like(script_lower,"%kerberos::ptt%") OR like(script_lower,"%kerberos::golden%"),5,0) + + | eval invoke_expression_keyword=if(like(script_lower,"%iex %") OR like(script_lower,"%invoke-expression %"),2,0) + + | eval webclient=if(like(script_lower,"%webclient%") OR like(script_lower,"%webrequest%") OR like(script_lower,"%downloadfile%") OR like(script_lower,"%downloadstring%") OR like(script_lower,"%bitstransfer%") OR like(script_lower,"%internetexplorer.application%") OR like(script_lower,"%xmlhttp%"),5,0) + + | eval suspicious_keyword=if(match(script_lower, "(metasp|assemblybuilderaccess|reflection\.assembly|shellcode|injection|cnvert|shell\.application|start-process |rc4bytestream|system\.security\.cryptography|lsass\.exe|localadmin|lastloggedon|hijack|backupprivilege|ngrok|comsvcs|backdoor|brute.?force|port.?scan|exfiltration|exploit|disablerealtimemonitoring|beacon)"),1,0) + + | eval invoke_wmi_keyword=if(like(script_lower,"%wmiobject%") OR like(script_lower,"%wmimethod%") OR like(script_lower,"%remotewmi%") OR like(script_lower,"%powershellwmi%") OR like(script_lower,"%wmicommand%"),5,0) + + | eval downgrade_version=if(match(script_lower, "([-]ve*r*s*i*o*n*\s+2)") OR like(script_lower,"%powershell -version%"),3,0) + + | eval compression_keyword=if(match(script_lower, "gzipstream|::decompress|io.compression|write-zip|(expand|compress)-archive"),5,0) + + | eval invoke_command_keyword=if(like(script_lower,"%invoke-command%"), 4, 0) + + | eval Score=ecnoded_command_keyword + + suspicious_cmdlets + + suspicious_keyword + + compression_keyword + + downgrade_version + + mimikatz + + invoke_expression_keyword + + empire + + webclient + + invoke_wmi_keyword + + invoke_command_keyword + + base64_keyword + + | where Score>=4 OR mimikatz>0 OR suspicious_cmdlets>0 OR suspicious_keyword>0 + + | eval matched_rules=mvappend( + if(ecnoded_command_keyword>0, "Encoded Command Keywords", null()), + if(suspicious_cmdlets>0, "Suspicious Cmdlets", null()), + if(base64_keyword>0, "Base64 Keyword", null()), + if(empire>0, "Empire Framework Commands", null()), + if(mimikatz>0, "Mimikatz Keywords or Strings", null()), + if(invoke_expression_keyword>0, "Invoke Expression Keywords", null()), + if(webclient>0, "Webclient Keywords", null()), + if(suspicious_keyword>0, "Potentially Suspicious Keywords or Strings", null()), + if(invoke_wmi_keyword>0, "Invoke WMI Keywords", null()), + if(downgrade_version>0, "PowerShell Downgrade Version Attempt", null()), + if(compression_keyword>0, "Compression Keywords", null()), + if(invoke_command_keyword>0, "Invoke Command Keywords", null()) + ) + + | eval matched_rules=mvfilter(isnotnull(matched_rules)) + + | rename Computer as dest, UserID as user + + | stats max(Score) as Score values(matched_rules) as matched_rules + BY user dest ScriptBlockId + + | eval matched_rules=mvjoin(matched_rules, ", ") + + | `powershell_4104_hunting_filter` +how_to_implement: |- + The following Hunting analytic requires PowerShell operational logs to be ingested with ScriptBlockLogging enabled. + Modify the powershell macro as needed to match the sourcetype or add index. + This analytic is specific to EventID 4104, or PowerShell Script Block Logging. known_false_positives: Limited false positives. May filter as needed. references: - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md @@ -90,6 +163,8 @@ analytic_story: asset_type: Endpoint mitre_attack_id: - T1059.001 + - T1689 + - T1003 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 64062460cb..1ac3be2323 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -1,31 +1,73 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -version: 20 +version: 21 creation_date: '2019-10-16' -modification_date: '2026-05-13' -author: David Dorsey, Michael Haag, Teoderick Contreras, Splunk +modification_date: '2026-08-23' +author: David Dorsey, Michael Haag, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: TTP -description: The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise. +description: |- + The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. + This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. + If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") Processes.process IN ("*System*", "*Security*", "*Setup*", "*Application*", "*trace*", "*powershell*", "Sysmon") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.process_name="wevtutil.exe" + OR + Processes.original_file_name="wevtutil.exe" + ) + + Processes.process IN ("* cl *", "*clear-log*") + Processes.process IN ( + "*/Trace*", + "*AMSI/Debug*", + "*Application*", + "*CiscoSecureEndpoint*", + "*Microsoft-Windows-BitLocker*", + "*Microsoft-Windows-Bits*", + "*Microsoft-Windows-CAPI2*", + "*Microsoft-Windows-Kernel-File*", + "*Microsoft-Windows-Kernel-Process*", + "*Microsoft-Windows-LDAP*", + "*Microsoft-Windows-PowerShell*", + "*Microsoft-Windows-Sysmon*", + "*Microsoft-Windows-TerminalServices-LocalSessionManager*", + "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*", + "*Microsoft-Windows-WMI-Activity*", + "*OpenSSH/*", + "*PowerShellCore/*", + "*Security*", + "*Setup*", + "*System*", + "*Windows Firewall With Advanced Security*", + "*Windows PowerShell*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md diff --git a/detections/endpoint/windows_process_execution_in_temp_dir.yml b/detections/endpoint/windows_process_execution_in_temp_dir.yml index 0f799e87ec..3d7554e0a2 100644 --- a/detections/endpoint/windows_process_execution_in_temp_dir.yml +++ b/detections/endpoint/windows_process_execution_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Process Execution in Temp Dir id: f6fbe929-4187-4ba4-901e-8a34be838443 -version: 12 +version: 13 creation_date: '2021-05-07' -modification_date: '2026-06-08' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -37,7 +37,7 @@ intermediate_findings: message: Suspicious process $process_name$ running from temp directory- $process_path$ on host- $dest$ threat_objects: - field: process_path - type: process_name + type: file_path analytic_story: - AgentTesla - XWorm diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index bae7c63144..4cf1735d21 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 28 +version: 29 creation_date: '2021-05-07' -modification_date: '2026-08-14' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: TTP @@ -37,7 +37,7 @@ finding: score: 50 threat_objects: - field: process_path - type: process_name + type: file_path analytic_story: - StealC Stealer - PlugX diff --git a/detections/endpoint/windows_tinycc_shellcode_execution.yml b/detections/endpoint/windows_tinycc_shellcode_execution.yml index 4b2ce5bd04..0d0bbec806 100644 --- a/detections/endpoint/windows_tinycc_shellcode_execution.yml +++ b/detections/endpoint/windows_tinycc_shellcode_execution.yml @@ -1,35 +1,43 @@ name: Windows TinyCC Shellcode Execution id: fdb6774e-e465-4912-86e3-63cf9ab91491 -version: 3 +version: 4 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Michael Haag, Splunk status: production type: TTP description: | - Detects abuse of Tiny-C-Compiler (TinyCC) for shellcode execution, where tcc.exe is renamed to masquerade as svchost.exe and used to compile and execute C source files containing shellcode. This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers renamed tcc.exe to svchost.exe and executed conf.c containing Metasploit block_api shellcode with the flags -nostdlib -run. - TinyCC is a legitimate C compiler, but its ability to compile and execute code on-the-fly makes it attractive to attackers seeking to evade detection. The combination of a renamed compiler binary executing from non-standard locations with suspicious flags is a strong indicator of malicious activity. + Detects abuse of Tiny-C-Compiler (TinyCC) for shellcode execution, where tcc.exe is renamed to masquerade as svchost.exe and used to compile and execute C source files containing shellcode. + This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers renamed "tcc.exe" to "svchost.exe", and executed a file named "conf.c" containing Metasploit block_api shellcode with the flags -nostdlib -run. + TinyCC is a legitimate C compiler, but its ability to compile and execute code on-the-fly makes it attractive to attackers seeking to evade detection. + The combination of a renamed compiler binary executing from non-standard locations with suspicious flags is a strong indicator of malicious activity. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where - Processes.process_name IN ("svchost.exe", "tcc.exe") - Processes.process="* -nostdlib*" - Processes.process="* -run*" - Processes.process IN ("*.c", "*conf.c*") - NOT Processes.process_path IN ( + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name IN ("svchost.exe", "tcc.exe") + Processes.process="* -nostdlib*" + Processes.process="* -run*" + Processes.process IN ("*.c", "*conf.c*") + NOT Processes.process_path IN ( "*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*" - ) - by Processes.action Processes.dest Processes.user Processes.process Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process_name Processes.process_id - Processes.process_exec Processes.process_guid Processes.process_hash - Processes.process_integrity_level Processes.process_path - Processes.original_file_name Processes.user_id Processes.vendor_product + ) + + By Processes.action Processes.dest Processes.user Processes.process Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process_name Processes.process_id + Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_integrity_level Processes.process_path + Processes.original_file_name Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -61,7 +69,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: TinyCC compiler execution on $dest$ by user $user$ from $process_path$, indicating potential malicious code execution. + title: TinyCC compiler execution on [$dest$] by user [$user$] from [$process_path$] via the CommandLine [$process$] from the ParentProcess [$parent_process$], indicating potential malicious code execution. entity: field: user type: user @@ -71,7 +79,7 @@ intermediate_findings: - field: dest type: system score: 50 - message: TinyCC compiler execution on $dest$ by user $user$ from $process_path$, indicating potential malicious code execution. + message: TinyCC compiler execution on [$dest$] by user [$user$] from [$process_path$] via the CommandLine [$process$] from the ParentProcess [$parent_process$], indicating potential malicious code execution. threat_objects: - field: process type: process diff --git a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml index a029952d94..aef8ef031f 100644 --- a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml +++ b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml @@ -1,8 +1,8 @@ name: Windows Unusual SysWOW64 Process Run System32 Executable id: e4602172-db86-4315-86df-da66fb40bcde -version: 6 +version: 7 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -32,7 +32,7 @@ intermediate_findings: message: a 32 bit process execute 64 bit executable on [$dest$]. threat_objects: - field: process_path - type: process_name + type: file_path analytic_story: - DarkGate Malware - Salt Typhoon diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml index 95a935dad4..f844c99680 100644 --- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml +++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml @@ -1,8 +1,8 @@ name: Citrix ADC Exploitation CVE-2023-3519 id: 76ac2dcb-333c-4a77-8ae9-2720cfae47a8 -version: 9 +version: 10 creation_date: '2023-07-21' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Michael Haag, Splunk status: production type: Hunting @@ -21,16 +21,18 @@ search: |- Web.http_method=POST Web.url IN ( "*/cgi/logout", + "*/cgi/samlart?samlart=*", + "*/cgi/samlauth", + "*/gwtest/formssso?event=start&target=*", + "*/netscaler/ns_gui/vpn/*", "*/saml/activelogin", - "*/saml/login", - "/cgi/samlart?samlart=*", - "/cgi/samlauth", - "/gwtest/formssso?event=start&target=*", - "/netscaler/ns_gui/vpn/*" + "*/saml/login" ) - BY Web.http_user_agent, Web.status + + BY Web.http_user_agent Web.status Web.http_method Web.url Web.url_length Web.src Web.dest + | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/removed/stories/lateral_movement.yml b/removed/stories/lateral_movement.yml index c719981403..e3583c0a18 100644 --- a/removed/stories/lateral_movement.yml +++ b/removed/stories/lateral_movement.yml @@ -1,8 +1,8 @@ name: Lateral Movement id: 399d65dc-1f08-499b-a259-abd9051f38ad -version: 3 +version: 4 creation_date: '2023-02-21' -modification_date: '2026-05-13' +modification_date: '2026-08-26' author: David Dorsey, Splunk status: removed description: "DEPRECATED IN FAVOR OF ACTIVE DIRECTORY LATERAL MOVEMENT. Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts." @@ -21,4 +21,4 @@ deprecation_info: reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity removed_in_version: 5.2.0 replacement_content: - - Compromised User Account + - Active Directory Lateral Movement From e86ae0ff5c0190ef92d74700952c254666d588cf Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Fri, 4 Sep 2026 20:47:14 +0200 Subject: [PATCH 094/164] Minor Fixes Against False Positive Patterns (#4249) --------- Co-authored-by: Nasreddine Bencherchali --- ...ux_adding_crontab_using_list_parameter.yml | 11 ++- .../jscript_execution_using_cscript_app.yml | 70 +++++++++++------ .../endpoint/linux_crontab_enumeration.yml | 76 ++++++++++++++++++ .../windows_private_keys_discovery.yml | 78 ++++++++++++++----- 4 files changed, 188 insertions(+), 47 deletions(-) rename detections/{endpoint => deprecated}/linux_adding_crontab_using_list_parameter.yml (91%) create mode 100644 detections/endpoint/linux_crontab_enumeration.yml diff --git a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml b/detections/deprecated/linux_adding_crontab_using_list_parameter.yml similarity index 91% rename from detections/endpoint/linux_adding_crontab_using_list_parameter.yml rename to detections/deprecated/linux_adding_crontab_using_list_parameter.yml index 379e5c6183..6c550de21d 100644 --- a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml +++ b/detections/deprecated/linux_adding_crontab_using_list_parameter.yml @@ -1,10 +1,10 @@ name: Linux Adding Crontab Using List Parameter id: 52f6d751-1fd4-4c74-a4c9-777ecfeb5c58 -version: 11 +version: 12 creation_date: '2021-12-21' -modification_date: '2026-05-13' +modification_date: '2026-09-03' author: Teoderick Contreras, Bhavin Patel, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects suspicious modifications to cron jobs on Linux systems using the crontab command with list parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt to establish persistence or execute malicious code on a schedule. If confirmed malicious, the impact could include unauthorized code execution, data destruction, or other damaging outcomes. Further investigation should analyze the added cron job, its associated command, and any related processes. data_source: @@ -60,3 +60,8 @@ tests: source: not_applicable sourcetype: cisco:isovalent:processExec test_type: unit +deprecation_info: + reason: Detection deprecated as its name and description are not matching the behavior of the search. The search is looking for crontab command with list parameter, not adding a new cron job. + removed_in_version: 6.8.0 + replacement_content: + - Linux Crontab Enumeration diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 422eeccc3e..4082fc5412 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -1,39 +1,60 @@ name: Jscript Execution Using Cscript App id: 002f1e24-146e-11ec-a470-acde48001122 -version: 13 +version: 14 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-08-31' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the execution of JScript using the cscript.exe process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics. If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise. +type: Anomaly +description: |- + The following analytic detects the execution of JScript using the cscript.exe process. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. + This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics. + If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise. data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE ( + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + ( + ( Processes.parent_process_name = "cscript.exe" - AND Processes.parent_process = "*//e:jscript*" ) - OR (Processes.process_name = "cscript.exe" AND Processes.process = "*//e:jscript*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + OR + ( + Processes.process_name = "cscript.exe" + Processes.process = "*//e:jscript*" + ) + ) + + NOT Processes.process="*/Job:AgentHIScript*" + NOT Processes.parent_process="*/Job:AgentHIScript*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Symantec Host Integrity check uses Jscript through cscript.exe references: - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation - https://attack.mitre.org/groups/G0046/ + - https://nasbench.medium.com/symantec-endpoint-protection-meets-com-using-symantec-sshelper-as-a-lolbin-40d515a121ce drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -43,18 +64,17 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Process name $process_name$ with commandline $process$ to execute jscript on $dest$ - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: Process name $process_name$ with commandline $process$ to execute jscript on $dest$ + score: 20 + message: The process [$parent_process_name$] with commandline [$parent_process$] launched [$process_name$] with commandline [$process$] on [$dest$] +threat_objects: + - field: parent_process + type: process + - field: process + type: process analytic_story: - FIN7 - Remcos diff --git a/detections/endpoint/linux_crontab_enumeration.yml b/detections/endpoint/linux_crontab_enumeration.yml new file mode 100644 index 0000000000..fbbe3ecedd --- /dev/null +++ b/detections/endpoint/linux_crontab_enumeration.yml @@ -0,0 +1,76 @@ +name: Linux Crontab Enumeration +id: 8ef82980-0e95-43d7-a802-b488b668d14f +version: 1 +creation_date: '2026-09-03' +modification_date: '2026-09-03' +author: Teoderick Contreras, Bhavin Patel, Onur Mustafa Erdogan, Splunk +status: production +type: Hunting +description: |- + The following analytic detects the use of the crontab command with the list parameter (-l) to enumerate scheduled tasks configured in the invoking user's crontab on Linux systems. + Adversaries may use this information to identify persistence mechanisms, scheduled execution, or potential privilege escalation opportunities. + The use of crontab -l is also common administrative activity and may require tuning based on the executing user, parent process, and environment. +data_source: + - Sysmon for Linux EventID 1 + - Cisco Isovalent Process Exec +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name = "crontab" + Processes.process= "* -l*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_crontab_enumeration_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +references: + - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ + - https://cert.gov.ua/article/39518 +analytic_story: + - Cisco Isovalent Suspicious Activity + - Industroyer2 + - Linux Privilege Escalation + - Linux Living Off The Land + - Data Destruction + - Linux Persistence Techniques + - Scheduled Tasks + - Gomir + - VoidLink Cloud-Native Linux Malware +asset_type: Endpoint +mitre_attack_id: + - T1053.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux + test_type: unit + - name: True Positive Test - Cisco Isovalent + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_isovalent/cisco_isovalent.log + source: not_applicable + sourcetype: cisco:isovalent:processExec + test_type: unit diff --git a/detections/endpoint/windows_private_keys_discovery.yml b/detections/endpoint/windows_private_keys_discovery.yml index 987fe3bc56..b55f95f5e9 100644 --- a/detections/endpoint/windows_private_keys_discovery.yml +++ b/detections/endpoint/windows_private_keys_discovery.yml @@ -1,36 +1,71 @@ name: Windows Private Keys Discovery id: 5c1c2877-06c0-40ee-a1a2-db71f1372b5b -version: 12 +version: 13 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-08-31' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies processes that retrieve information related to private key files, often used by post-exploitation tools like winpeas. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that search for private key certificates. This activity is significant as it indicates potential attempts to locate insecurely stored credentials, which adversaries can exploit for privilege escalation, persistence, or remote service authentication. If confirmed malicious, this behavior could allow attackers to access sensitive information, escalate privileges, or maintain persistence within the compromised environment. +description: |- + The following analytic identifies processes that retrieve information related to private key files, often used by post-exploitation tools like winpeas. + This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that search for private key certificates. + This activity is significant as it indicates potential attempts to locate insecurely stored credentials, which adversaries can exploit for privilege escalation, persistence, or remote service authentication. + If confirmed malicious, this behavior could allow attackers to access sensitive information, escalate privileges, or maintain persistence within the compromised environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process = "*dir *" - OR - Processes.process = "*findstr*" - AND - Processes.process IN ( "*.rdg*", "*.gpg*", "*.pgp*", "*.p12*", "*.der*", "*.csr*", "*.cer*", "*.ovpn*", "*.key*", "*.ppk*", "*.p12*", "*.pem*", "*.pfx*", "*.p7b*", "*.asc*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name IN ( + "cmd.exe", + "findstr.exe", + "powershell.exe", + "pwsh.exe" + ) + Processes.process IN ( + "*.asc*", + "*.cer*", + "*.csr*", + "*.der*", + "*.gpg*", + "*.key*", + "*.ovpn*", + "*.p12*", + "*.p12*", + "*.p7b*", + "*.pem*", + "*.pfx*", + "*.pgp*", + "*.ppk*", + "*.rdg*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + + | regex process="(?i)[^\.\-\_\$a-zA-Z](dir\s|findstr)" + | regex process="(?i)\.(?:rdg|gpg|pgp|p12|der|csr|cer|ovpn|key|ppk|p12|pem|pfx|p7b|asc)\b" + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_private_keys_discovery_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Very long command line arguments may contain these keywords in irrelevant sections of the code. references: - https://attack.mitre.org/techniques/T1552/004/ - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS @@ -49,7 +84,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: a process with commandline $process$ that can retrieve information related to private keys on $dest$ + message: A process with commandline [$process$] that can retrieve information related to private keys was executed on [$dest$] +threat_objects: + - field: parent_process + type: process + - field: process + type: process analytic_story: - Windows Post-Exploitation - Prestige Ransomware From 3e317f4d735e8862fd2d0b142e53179efc022fd9 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Sat, 5 Sep 2026 17:29:37 +0200 Subject: [PATCH 095/164] macOS detection: MacOS AppleScript Shell Execution and Compilation (#4257) --------- Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- ...script_shell_execution_and_compilation.yml | 93 +++++++++++++++++++ 1 file changed, 93 insertions(+) create mode 100644 detections/endpoint/macos_applescript_shell_execution_and_compilation.yml diff --git a/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml b/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml new file mode 100644 index 0000000000..be5632f118 --- /dev/null +++ b/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml @@ -0,0 +1,93 @@ +name: MacOS AppleScript Shell Execution and Compilation +id: ceee1f2b-4b40-4721-b91e-40d1134e9dc4 +version: 1 +creation_date: '2026-09-03' +modification_date: '2026-09-03' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic. + The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host. + It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly. + Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name IN ("osascript", "osacompile") + Processes.process="*do *" + Processes.process="* shell *" + Processes.process="* script*" + + BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval activity_type=case( + process_name="osascript", "AppleScript Shell Command Execution", + process_name="osacompile", "AppleScript Compilation or Staging" + ) + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table firstTime lastTime dest user activity_type parent_process process parent_process_name parent_process_exec parent_process_guid parent_process_id parent_process_path process_exec process_guid process_hash process_id process_integrity_level process_name process_path action user_id vendor_product + + | `macos_applescript_shell_execution_and_compilation_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the TA-OSquery (https://splunkbase.splunk.com/app/8574) must be deployed in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative scripts or automation tools using Applescript. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://www.loobins.io/binaries/osascript/ + - https://redcanary.com/threat-detection-report/techniques/applescript/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: AppleScript shell execution or compilation via [$process_name$] with commandline [$process$] was observed on [$dest$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log + source: osquery + sourcetype: osquery:results + test_type: unit From e99ef188ec0dc299be0baf2ce3c9543a5d60a21b Mon Sep 17 00:00:00 2001 From: themaryjo Date: Sat, 5 Sep 2026 19:45:50 +0200 Subject: [PATCH 096/164] Add `Browser Spawned Unix Shell with External Connection` (#4256) --------- Co-authored-by: oerdogan Co-authored-by: Nasreddine Bencherchali --- ...ed_unix_shell_with_external_connection.yml | 116 ++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml new file mode 100644 index 0000000000..768ff926ec --- /dev/null +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -0,0 +1,116 @@ +name: Cisco NVM - Browser Spawned Unix Shell with External Connection +id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 +version: 1 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Maria Jose Erquiaga, Splunk +status: production +type: Anomaly +description: | + Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination. + This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems. + The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows. +data_source: + - Cisco Network Visibility Module Flow Data +search: | + `cisco_network_visibility_module_flowdata` + process_path IN ( + "*/bash", + "*/csh", + "*/dash", + "*/fish", + "*/sh", + "*/tcsh", + "*/zsh" + ) + parent_process_path IN ( + "*/arc", "*/brave", "*/brave-browser", "*/chrome", "*/chromium", "*/duckduckgo", "*/firefox", "*/firefox-bin", + "*/google chrome", "*/google-chrome", "*/librewolf", "*/microsoft edge", "*/msedge", "*/opera", + "*/opera gx", "*/safari", "*/tor browser", "*/vivaldi", "*/waterfox" + ) + NOT dest IN ( + "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", + "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", + "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", + "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24", + "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1" + ) + + | stats count + min(_time) as firstTime + max(_time) as lastTime + values(parent_process_hash) as parent_process_hash + values(process_hash) as process_hash + values(module_name_list) as module_name_list + values(module_hash_list) as module_hash_list + values(dest_port) as dest_port + values(dest_hostname) as dest_hostname + + by src src_ip dest dest_ip bytes_in bytes_out + user process_id process_name process_path process + parent_process_id parent_process_name parent_process_path parent_process + + | table + firstTime lastTime user + parent_process_path parent_process_name parent_process parent_process_hash + process_path process_name process process_hash process_id + module_name_list module_hash_list + src src_ip dest_hostname dest dest_ip dest_port bytes_in bytes_out + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter` +how_to_implement: | + This search requires Network Visibility Module logs, which includes the flow data sourcetype. + This search uses an input macro named `cisco_network_visibility_module_flowdata`. + We strongly recommend that you specify your environment-specific configurations + (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + Replace the macro definition with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. + The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). +known_false_positives: | + Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/ + - https://redcanary.com/threat-detection-report/threats/socgholish/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src="$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: A Unix-based browser process [$parent_process$] spawned shell [$process$] on host [$src$], which made an outbound connection to external destination [$dest_hostname$] with IP [$dest_ip$] on port [$dest_port$]. +threat_objects: + - field: process + type: process + - field: dest_ip + type: ip_address + - field: dest_hostname + type: domain +analytic_story: + - Cisco Network Visibility Module Analytics +asset_type: Endpoint +mitre_attack_id: + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test - Cisco NVM + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log + source: not_applicable + sourcetype: cisco:nvm:flowdata:v2 + test_type: unit From aaf2ed21ff396a4847d71566c6e76ffbee807f49 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Sun, 6 Sep 2026 15:16:06 -0400 Subject: [PATCH 097/164] Add Coverage For CVE-2026-47301 (#4236) --------- Co-authored-by: oerdogan Co-authored-by: Nasreddine Bencherchali --- .../endpoint/powershell_4104_hunting.yml | 9 +- ...ndows_builtin_account_name_was_changed.yml | 79 +++++++++++++ .../endpoint/windows_cab_file_on_disk.yml | 73 +++++++++--- ..._was_planted_in_sms_provider_directory.yml | 88 ++++++++++++++ ...xec_spawned_a_suspicious_child_process.yml | 110 ++++++++++++++++++ 5 files changed, 339 insertions(+), 20 deletions(-) create mode 100644 detections/endpoint/windows_builtin_account_name_was_changed.yml create mode 100644 detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml create mode 100644 detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index b52db6e54f..2626558819 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -16,7 +16,8 @@ search: |- EventCode=4104 ScriptBlockText IN ( - "*-dumpcr%*", "*::decompress*", "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", + "*-dumpcr%*", "* -version *", "*::decompress*", + "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*", "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*", "*CachedRDPConnection*", "*Check-VM*", "*cnvert*", "*compress-archive*", "*ComputerProperty*", @@ -24,8 +25,8 @@ search: |- "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*", "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*", "*Find-*", "*Frombase64_keyword*", "*Get-ApplicationHost*", "*Get-ChromeDump*", - "*Get-ClipboardContents*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", - "*Get-Keystrokes*", "*Get-PassHash*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", + "*Get-ClipboardContents*", "*Get-*Credent*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", + "*Get-Keystrokes*", "*Get-PassHash*", "*Get-*Password*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*", "*Get-ServicePermission*", "*Get-ServiceUnquoted*", "*Get-SiteListPassword*", "*Get-System*", "*Get-TimedScreenshot*", "*Get-UnattendedInstallFile*", @@ -67,7 +68,7 @@ search: |- | eval invoke_wmi_keyword=if(like(script_lower,"%wmiobject%") OR like(script_lower,"%wmimethod%") OR like(script_lower,"%remotewmi%") OR like(script_lower,"%powershellwmi%") OR like(script_lower,"%wmicommand%"),5,0) - | eval downgrade_version=if(match(script_lower, "([-]ve*r*s*i*o*n*\s+2)") OR like(script_lower,"%powershell -version%"),3,0) + | eval downgrade_version=if(like(script_lower, "% -version 2%"),3,0) | eval compression_keyword=if(match(script_lower, "gzipstream|::decompress|io.compression|write-zip|(expand|compress)-archive"),5,0) diff --git a/detections/endpoint/windows_builtin_account_name_was_changed.yml b/detections/endpoint/windows_builtin_account_name_was_changed.yml new file mode 100644 index 0000000000..5981a964fb --- /dev/null +++ b/detections/endpoint/windows_builtin_account_name_was_changed.yml @@ -0,0 +1,79 @@ +name: Windows Builtin Account Name Was Changed +id: 65e6e8b9-c68c-460f-beb8-48cfe91b4d21 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects renaming of Windows built-in accounts via Event ID 4781. + It identifies renames targeting accounts with well-known reserved RIDs (500-504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern. + Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account. + Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment. +data_source: + - Windows Event Log Security 4781 +search: |- + `wineventlog_security` + EventCode=4781 + TargetSid="S-1-5-21-*" + + | where match(TargetSid, "S-1-5-21-.*-50[0-4]$") + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest OldTargetUserName NewTargetUserName + TargetSid SubjectLogonId + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_builtin_account_name_was_changed_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. +known_false_positives: |- + Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts. + Validate the source user, logon ID, and timing against expected change control windows before tuning. +references: + - https://attack.mitre.org/techniques/T1078/003/ + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781 + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" and "$OldTargetUserName$" + search: '%original_detection_search% | search dest = "$dest$" OldTargetUserName = "$OldTargetUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Built-in account [$OldTargetUserName$] (SID [$TargetSid$]) was renamed to [$NewTargetUserName$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: NewTargetUserName + type: user +analytic_story: + - Windows Defense Evasion Tactics + - Compromised Windows Host +asset_type: Endpoint +mitre_attack_id: + - T1078.003 + - T1036.010 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_cab_file_on_disk.yml b/detections/endpoint/windows_cab_file_on_disk.yml index 5d9220feba..878f72ce35 100644 --- a/detections/endpoint/windows_cab_file_on_disk.yml +++ b/detections/endpoint/windows_cab_file_on_disk.yml @@ -1,30 +1,66 @@ name: Windows CAB File on Disk id: 622f08d0-69ef-42c2-8139-66088bc25acd -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' -author: Michael Haag, Splunk +modification_date: '2026-08-24' +author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects .cab files being written to disk. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'. This activity is significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. Analysts should review the file path and associated artifacts for further investigation. +description: |- + The following analytic detects .cab files being written to disk. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'. + This activity can be significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. + If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. + Analysts should review the file path and associated artifacts for further investigation. data_source: - Sysmon EventID 11 search: |- - | tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - WHERE ( - Filesystem.file_name=*.cab - ) - BY Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path Filesystem.file_acl - Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product + | tstats `security_content_summariesonly` + count values(Filesystem.file_path) as file_path + min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.action IN ("created", "modified") + Filesystem.file_name="*.cab" + NOT Filesystem.file_path IN ( + "*\\AppData\\Local\\Microsoft\\*", + "*\\Windows Kits\\10\\ADK\\Installers\\*", + "C:\\Program Files (x86)\\*", + "C:\\Program Files\\*", + "C:\\ProgramData\\Microsoft\\*", + "C:\\ProgramData\\Package Cache\\*", + "C:\\Windows\\appcompat\\*", + "C:\\Windows\\Logs\\CBS\\*", + "C:\\Windows\\servicing\\*", + "C:\\Windows\\SoftwareDistribution\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SystemApps\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Windows\\WinSxS\\*", + ) + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cab_file_on_disk_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives will only be present if a process legitimately writes a .cab file to disk. Modify the analytic as needed by file path. Filter as needed. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. + To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some false positives are expected from user controlled folders. references: - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt drilldown_searches: @@ -41,11 +77,16 @@ intermediate_findings: - field: dest type: system score: 20 - message: A .cab file was written to disk on endpoint $dest$. + message: The file [$file_path$] with a .cab extension was written to disk on endpoint $dest$. +threat_objects: + - field: file_path + type: file_path analytic_story: - DarkGate Malware - APT37 Rustonotto and FadeStealer asset_type: Endpoint +cve: + - CVE-2026-47301 mitre_attack_id: - T1566.001 product: diff --git a/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml new file mode 100644 index 0000000000..dff7ccf275 --- /dev/null +++ b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml @@ -0,0 +1,88 @@ +name: Windows SCCM Adsource DLL Was Planted In SMS Provider Directory +id: 4f55b07b-7aeb-47f4-a234-b222a902276b +version: 1 +creation_date: '2026-08-20' +modification_date: '2026-08-20' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects the creation or modification of adsource.dll or other staging files with the name adsource_*.dll within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301. + This abuses a DLL side-loading vulnerability in the Microsoft Configuration Manager SMS Provider component. + An attacker can plant a malicious adsource.dll in the SCCMProvider bin\X64 path, causing the SMS Provider service to load the attacker-controlled library in a privileged context. + The presence of renamed dlls alongside adsource.dll is a strong indicator of the classic DLL hijacking pattern where the legitimate library has been renamed so the malicious replacement can proxy calls to it. + If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role. +data_source: + - Sysmon EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created", "modified") + Filesystem.file_name IN ( + "adsource.dll", + "adsource_*.dll" + ) + Filesystem.file_path="*Microsoft Configuration Manager\\bin\\X64\\*" + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter` +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder. +known_false_positives: |- + Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory. + Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning. +references: + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Suspicious SCCM adsource DLL [$file_name$] detected at [$file_path$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path +analytic_story: + - Windows Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-47301 +mitre_attack_id: + - T1574.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml new file mode 100644 index 0000000000..e93cc7f693 --- /dev/null +++ b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml @@ -0,0 +1,110 @@ +name: Windows SCCM Smsexec Spawned a Suspicious Child Process +id: 72091a05-3008-4330-b43e-f5e070134ec1 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe. + smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters. + An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe. + If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_name="smsexec.exe" + Processes.process_name IN ( + "bitsadmin.exe", + "certutil.exe", + "cmd.exe", + "conhost.exe", + "cscript.exe", + "curl.exe", + "mshta.exe", + "net.exe", + "net1.exe", + "powershell.exe", + "pwsh.exe", + "reg.exe", + "regsvr32.exe", + "rundll32.exe", + "wmic.exe", + "wscript.exe" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_sccm_smsexec_spawned_a_suspicious_child_process_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + smsexec.exe is not expected to spawn interactive shells or scripting engines under normal operating conditions. + False positives are unlikely. Validate the full command line and file hash of any match before tuning. +references: + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://attack.mitre.org/techniques/T1574/001/ + - https://attack.mitre.org/techniques/T1068/ + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 50 + message: Suspicious child process [$process_name$] with Command Line [$process$] spawned by [$parent_process_path$] on [$dest$] +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Windows Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-47301 +mitre_attack_id: + - T1574.001 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From 4265636126f24ed21e104ceea149df6f6821abd9 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 7 Sep 2026 00:14:40 +0200 Subject: [PATCH 098/164] macOS detection: MacOS Osascript Displaying Suspicious User Prompt (#4250) --------- Co-authored-by: oerdogan Co-authored-by: Nasreddine Bencherchali --- ...ript_displaying_suspicious_user_prompt.yml | 101 ++++++++++++++++++ 1 file changed, 101 insertions(+) create mode 100644 detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml diff --git a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml new file mode 100644 index 0000000000..b3a93b8066 --- /dev/null +++ b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml @@ -0,0 +1,101 @@ +name: MacOS Osascript Displaying Suspicious User Prompt +id: d565ae18-7db6-460c-a2eb-a7109f18bc5e +version: 1 +creation_date: '2026-08-03' +modification_date: '2026-08-31' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content. + Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information. + This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name="osascript" + Processes.process IN ( + "*display alert*", + "*display dialog*" + ) + Processes.process IN ( + "*access System*", + "*authentication*", + "*credentials*", + "*critical update*", + "*needs your attention*", + "*password*", + "*security update*", + "*system error*", + "*verify*", + "*with hidden answer*" + ) + + BY Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_osascript_displaying_suspicious_user_prompt_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative, MDM, software deployment, support, or automation scripts may use osascript to display dialogs or alerts. Review the parent process, executing user, script content, signer, and known administrative tooling before suppressing the activity. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/tactics/TA0006/ + - https://attack.mitre.org/techniques/T1056/002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://www.loobins.io/binaries/osascript/ + - https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1 + - https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/ + - https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The osascript utility executed a command containing dialog-related and potentially deceptive content on endpoint [$dest$] with the Command Line [$process$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1056.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log + source: osquery + sourcetype: osquery:results + test_type: unit From 225e7057961666cbab51df615146d82e0d73eeee Mon Sep 17 00:00:00 2001 From: themaryjo Date: Mon, 7 Sep 2026 02:03:40 +0200 Subject: [PATCH 099/164] Add Socat Utility Detections (#4253) --------- Co-authored-by: oerdogan Co-authored-by: Nasreddine Bencherchali --- ...network_listener_binding_an_executable.yml | 91 +++++++++++++++++++ ...cp_connection_with_local_echo_disabled.yml | 90 ++++++++++++++++++ 2 files changed, 181 insertions(+) create mode 100644 detections/endpoint/socat_network_listener_binding_an_executable.yml create mode 100644 detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml diff --git a/detections/endpoint/socat_network_listener_binding_an_executable.yml b/detections/endpoint/socat_network_listener_binding_an_executable.yml new file mode 100644 index 0000000000..2ff67a8fe4 --- /dev/null +++ b/detections/endpoint/socat_network_listener_binding_an_executable.yml @@ -0,0 +1,91 @@ +name: Socat Network Listener Binding an Executable +id: 72482d45-1d05-46f5-bb6c-e2b709a8073a +version: 1 +creation_date: '2026-08-27' +modification_date: '2026-08-27' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections. + Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement. +data_source: + - Osquery Results + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count + min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name="socat*" + Processes.process="*exec:*" + Processes.process="*-listen:*" + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `socat_network_listener_binding_an_executable_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Developers, network engineers, and system administrators may use socat to expose benign executables for protocol testing, debugging, data transformation, or troubleshooting. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059 + - https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ + - https://gtfobins.github.io/gtfobins/socat/ + - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$]. + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1572 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log + source: osqueryd.results.log + sourcetype: osquery:results + test_type: unit diff --git a/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml b/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml new file mode 100644 index 0000000000..cc26421856 --- /dev/null +++ b/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml @@ -0,0 +1,90 @@ +name: Socat Remote TCP Connection with Local Echo Disabled +id: 458c6c37-116d-4f01-8267-f09f5b82cd14 +version: 1 +creation_date: '2026-08-27' +modification_date: '2026-08-27' +author: Maria Jose Erquiaga, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects execution of the socat utility with a remote TCP or OpenSSL connection and local terminal echo disabled. + This configuration may be used for interactive terminal sessions, password handling, automation, or network debugging. + When observed in an unexpected context, such as execution by an unusual parent process or connection to an untrusted endpoint, it may indicate suspicious remote access activity. +data_source: + - Osquery Results + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name="socat*" + Processes.process="*echo=0*" + Processes.process IN ( + "*openssl:*", + "*tcp:*", + "*tcp4:*", + "*tcp6:*" + ) + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `socat_remote_tcp_connection_with_local_echo_disabled_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Developers and network engineers may use socat with local echo disabled for legitimate TCP debugging, protocol testing, terminal handling, or troubleshooting. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059 + - https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ + - https://gtfobins.github.io/gtfobins/socat/ + - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Socat was executed with local terminal echo disabled and a remote TCP or OpenSSL connection via Command Line [$process$] on endpoint [$dest$] by user [$user$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1572 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log + source: osquery + sourcetype: osquery:results + test_type: unit From 855be185ec399520f5014edc089cd64b354c79b6 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 7 Sep 2026 15:14:33 +0200 Subject: [PATCH 100/164] Batch Fixes from Code Review (#4259) --- .github/workflows/update_nist_ai_rmf_detection_map.yml | 1 + detections/endpoint/powershell_4104_hunting.yml | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/update_nist_ai_rmf_detection_map.yml b/.github/workflows/update_nist_ai_rmf_detection_map.yml index 96f4d998ac..7d832fed6e 100644 --- a/.github/workflows/update_nist_ai_rmf_detection_map.yml +++ b/.github/workflows/update_nist_ai_rmf_detection_map.yml @@ -18,6 +18,7 @@ jobs: uses: actions/checkout@v7 with: ref: develop + persist-credentials: false - name: Set up Python uses: actions/setup-python@v6 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 2626558819..27058a2685 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -24,7 +24,7 @@ search: |- "*comsvcs*", "*copy-vss*", "*CreateShortcut*", "*disablerealtimemonitoring*", "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*", "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*", - "*Find-*", "*Frombase64_keyword*", "*Get-ApplicationHost*", "*Get-ChromeDump*", + "*Find-*", "*Frombase64*", "*Get-ApplicationHost*", "*Get-ChromeDump*", "*Get-ClipboardContents*", "*Get-*Credent*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", "*Get-Keystrokes*", "*Get-PassHash*", "*Get-*Password*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*", @@ -54,9 +54,9 @@ search: |- | eval suspicious_cmdlets=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|netfirewall|Uninstall-Windows|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) - | eval base64_keyword=if(like(script_lower,"%frombase64_keyword%"), 4, 0) + | eval base64_keyword=if(like(script_lower,"%Frombase64%"), 4, 0) - | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%frombase64_keywordstring%"),5,0) + | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%Frombase64%"),5,0) | eval mimikatz=if(like(script_lower,"%mimikatz%") OR like(script_lower,"%-dumpcr%") OR like(script_lower,"%sekurlsa::pth%") OR like(script_lower,"%kerberos::ptt%") OR like(script_lower,"%kerberos::golden%"),5,0) From 5b9754b4742405f2f75bedb4b2976d3025f9c723 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 7 Sep 2026 18:51:05 +0200 Subject: [PATCH 101/164] Batch fixes from code review (#4260) --- detections/endpoint/powershell_4104_hunting.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 27058a2685..006d345909 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -16,7 +16,7 @@ search: |- EventCode=4104 ScriptBlockText IN ( - "*-dumpcr%*", "* -version *", "*::decompress*", + "*-dumpcr*", "* -version *", "*::decompress*", "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*", "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*", @@ -54,9 +54,9 @@ search: |- | eval suspicious_cmdlets=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|netfirewall|Uninstall-Windows|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) - | eval base64_keyword=if(like(script_lower,"%Frombase64%"), 4, 0) + | eval base64_keyword=if(like(script_lower,"%frombase64%"), 4, 0) - | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%Frombase64%"),5,0) + | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%frombase64%"),5,0) | eval mimikatz=if(like(script_lower,"%mimikatz%") OR like(script_lower,"%-dumpcr%") OR like(script_lower,"%sekurlsa::pth%") OR like(script_lower,"%kerberos::ptt%") OR like(script_lower,"%kerberos::golden%"),5,0) From 4cd62e811c5eddf1245c780d48823d7b38998566 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Tue, 8 Sep 2026 10:56:33 +0200 Subject: [PATCH 102/164] Detection Against Content Copied From Browsers Executed through Run (#4261) --- data_sources/sysmon_eventid_24.yml | 84 ++++++++++++++++ ...ntent_copied_from_browser_was_executed.yml | 97 +++++++++++++++++++ 2 files changed, 181 insertions(+) create mode 100644 data_sources/sysmon_eventid_24.yml create mode 100644 detections/endpoint/windows_content_copied_from_browser_was_executed.yml diff --git a/data_sources/sysmon_eventid_24.yml b/data_sources/sysmon_eventid_24.yml new file mode 100644 index 0000000000..66a49773a6 --- /dev/null +++ b/data_sources/sysmon_eventid_24.yml @@ -0,0 +1,84 @@ +name: Sysmon EventID 24 +id: ae023710-3dbb-4de3-a1b2-5477a8ab74f9 +version: 1 +creation_date: '2024-09-07' +modification_date: '2024-09-07' +author: Onur Mustafa Erdogan, Splunk +description: Logs whenever new content is copied into the clipboard, including details about the associated process, hash of the content, and the time of copying. +mitre_components: + - Process Metadata + - Process Access + - Application Log Content + - OS API Execution +source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +sourcetype: XmlWinEventLog +separator: EventID +separator_value: '24' +configuration: https://github.com/SwiftOnSecurity/sysmon-config +supported_TA: + - name: Splunk Add-on for Sysmon + url: https://splunkbase.splunk.com/app/5709 + version: 5.0.1 +fields: + - _time + - Archived + - Channel + - ClientInfo + - Computer + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - Guid + - Hashes + - IMPHASH + - Image + - Keywords + - Level + - MD5 + - Name + - Opcode + - ProcessGuid + - ProcessID + - ProcessId + - RecordID + - RecordNumber + - RuleName + - SHA256 + - SecurityID + - Session + - SrcHost + - SystemTime + - System_Props_Xml + - Task + - ThreadID + - TimeCreated + - User + - UserID + - UtcTime + - Version + - host + - id + - index + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype +output_fields: + - dest + - dvc + - event_id + - process_exec + - process_guid + - process_hash + - process_id + - process_name + - process_path + - severity + - splunk_server + - user + - vendor_product +example_log: 24542400x8000000000000000274447Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-07 14:37:28.999{1b43529b-bf4f-6a9e-e4eb-020000006600}8988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe2user EC2AMAZ-FKEOM7G\Administrator hostname OERDOGAN-M-7N5YMD5=F2CD63BD7E2B5F9B738F589AF3BB1F8F,SHA256=397EE4CA855D96072D57E89ABFCA9F83634DAEA133E5302CB0766E87FDC3FEFC,IMPHASH=00000000000000000000000000000000false - failed with error 1337EC2AMAZ-FKEOM7G\Administrator diff --git a/detections/endpoint/windows_content_copied_from_browser_was_executed.yml b/detections/endpoint/windows_content_copied_from_browser_was_executed.yml new file mode 100644 index 0000000000..ad9d178590 --- /dev/null +++ b/detections/endpoint/windows_content_copied_from_browser_was_executed.yml @@ -0,0 +1,97 @@ +name: Windows Content Copied from Browser was Executed +id: 5d1fdbcb-5ed9-4190-85c8-7f9026450a0b +version: 1 +creation_date: '2026-09-07' +modification_date: '2026-09-07' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic correlates modifications to the Windows RunMRU registry key with clipboard content + changes initiated by browsers. It aims to detect ClickFix scenarios in which commands copied + from a browser are subsequently executed on the Windows system through the Run dialog box. +data_source: + - Sysmon EventID 13 AND Sysmon EventID 24 +search: |- + `sysmon` + EventID IN (13, 24) + ( + registry_key_name=*RunMRU* + OR + process_name IN ( + "360se.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe", + "chrome.exe", "chromium.exe", "coccoc.exe", "dragon.exe", "duckduckgo.exe", "epic.exe", "firefox.exe", "ghost.exe", + "iexplore.exe", "iridium.exe", "iron.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe", + "msedgewebview2.exe", "opera.exe", "opera_autoupdate.exe", "perplexity.exe", "rave.exe", "safari.exe", "shift.exe", + "sidekick.exe", "thorium.exe", "torch.exe", "vivaldi.exe", "wavebrowser.exe", "whale.exe", "zen.exe" + ) + ) + | eval trimmed_command = rtrim(registry_value_data, "\1") + | eval utf16le_command = urldecode(replace(trimmed_command, "(.)", "\1%00")) + | eval sha256_process=upper(sha256(utf16le_command)) + | eval hash_command=coalesce(SHA256,sha256_process) + | stats min(_time) as firstTime max(_time) as lastTime values(process_name) as process_name + values(trimmed_command) as process values(EventID) as EventID dc(EventID) as dc_EventID count + by hash_command dest user + | search dc_EventID>1 + | eval process_name = mvfilter( + process_name IN ( + "360se.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe", + "chrome.exe", "chromium.exe", "coccoc.exe", "dragon.exe", "duckduckgo.exe", "epic.exe", "firefox.exe", "ghost.exe", + "iexplore.exe", "iridium.exe", "iron.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe", + "msedgewebview2.exe", "opera.exe", "opera_autoupdate.exe", "perplexity.exe", "rave.exe", "safari.exe", "shift.exe", + "sidekick.exe", "thorium.exe", "torch.exe", "vivaldi.exe", "wavebrowser.exe", "whale.exe", "zen.exe" + ) + ) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_content_copied_from_browser_was_executed_filter` +how_to_implement: |- + This detection requires Sysmon event logs. Configure your environment to ingest Sysmon registry modification (Event ID 13) + and clipboard change (Event ID 24) events. Ensure that registry modification events are collected for the RunMRU registry key + and clipboard change events are collected from common browser processes. Ingest the data through the appropriate Splunk technology + add-on and normalize field names using the Splunk Common Information Model (CIM). +known_false_positives: No false positives have been identified at this time. +references: + - https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/ + - https://www.huntress.com/blog/clickfix-matanbuchus-astarionrat-analysis +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The content [$process$] was copied from [$process_name$] to the clipboard and was executed through the Run dialog box on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: hash_command + type: process_hash +analytic_story: + - Fake CAPTCHA Campaigns +asset_type: Endpoint +mitre_attack_id: + - T1202 + - T1059.001 + - T1059.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/windows_browser_copy_paste/windows_browser_copy_paste.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From 2216f46e725cff8149beb2820663e8c15e5ce782 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 18 Sep 2026 15:51:19 -0700 Subject: [PATCH 103/164] Update data source TA and install.yml app versions (#4274) --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- data_sources/azure_active_directory.yml | 2 +- ...e_directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- data_sources/azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_microsoftgraphactivitylogs.yml | 2 +- .../azure_active_directory_noninteractiveusersigninlogs.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- data_sources/cisco_ai_defense_alerts.yml | 2 +- data_sources/cisco_asa_logs.yml | 2 +- data_sources/cisco_duo_activity.yml | 2 +- data_sources/cisco_duo_administrator.yml | 2 +- data_sources/cisco_isovalent_process_connect.yml | 2 +- data_sources/cisco_isovalent_process_exec.yml | 2 +- data_sources/cisco_isovalent_process_kprobe.yml | 2 +- data_sources/cisco_network_visibility_module_flow_data.yml | 2 +- data_sources/cisco_network_visibility_module_osquery.yml | 2 +- data_sources/cisco_secure_access_dns.yml | 2 +- data_sources/cisco_secure_access_firewall.yml | 2 +- data_sources/cisco_secure_access_proxy.yml | 2 +- .../cisco_secure_firewall_threat_defense_connection_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_file_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_intrusion_event.yml | 2 +- data_sources/crowdstrike_falcon_stream_alert.yml | 2 +- data_sources/crowdstrike_processrollup2.yml | 2 +- data_sources/github_enterprise_audit_logs.yml | 2 +- data_sources/github_organizations_audit_logs.yml | 2 +- data_sources/nginx_access.yml | 2 +- 105 files changed, 105 insertions(+), 105 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 177d51fa85..6fd1fe38ab 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 801a3882ea..5ca8401b63 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index e725a27c95..f74d5622d5 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 9ce661d969..771112afc1 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index 87c2702b27..a6cec23c06 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 1c5f94ecab..2ff6e5b714 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 042284fe75..4a3d0da170 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 90d25a6c4b..b0d5da0175 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 66946e9161..d0438d39af 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index e9c79a8b1a..6a3bc6f3c0 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index c1153a3068..c63acbb7ec 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 00c450ca5d..e66f77171f 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index 621812b8ec..c1b0c920e4 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index f84b2cf002..5288b8cbd4 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index bcc8f0593c..47342a57d8 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index 9c87fc438a..9e8c0336a0 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index 4364c10000..f328e4afb8 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 9aa2841257..81b65bfb0d 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 39d29d1a6f..9dd19beb76 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index d190093d91..eaaed2c844 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index bcf4fd5f84..bcf5a76f98 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 6cb149284f..8ca44cb904 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 0bacc4bbb4..86bd7aab68 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index d8aa0af29a..206581102a 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 32a576295d..45377a711c 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index fb8e5147f6..9f3946121a 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 6518df5b56..c7139fe37e 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 26b3ce7198..c0350a4711 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index f5c3a384fe..8b3f877fa3 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 95f67eb714..eaf32e0d25 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 888baf1d85..9a977502fa 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index e8eb028bb9..73fae76c7d 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 2a0af88997..0ff1b8bf84 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index bd587aed86..124ec4fdcd 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 3d389b31f6..b970da776a 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 5aa835619d..1cef1f3cee 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 191afb2bce..435cf6402e 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index e31315d18c..2130bc1392 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 27e9e0b3f1..b66fcd5be4 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 160dfe1db5..954e0181fb 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 4c419b3a63..7e6ef7089f 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index d2d1b63ce6..d2595753a7 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index c421ba7cb9..d18e6de7ea 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index f3898a6679..8fa3955282 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 3613f843e8..82d2e09109 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 4d47df2492..5391f2dc6f 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 1027f7c5f2..72d8807974 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 4877ea119c..a2c348f7a8 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index daa93d4c05..5d3dd4b85a 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index 452914db25..9eca348610 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index ebcd3e95b4..8a52e1dd16 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index d95a8e337f..dae12350ea 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 57b95d703a..3f1d2fd448 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 40e4c9ae5d..85693fd2c7 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 83e554a5ca..188e83923b 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index de9423c9c5..c7bbbe699d 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 106b623c2c..559857b474 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index f62c9e6417..b9140c0c4b 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index e8c6c5ae94..613fcc7750 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index c609919c95..a5c3a3a362 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index b165f0ace8..62efe79121 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.2.2 + version: 8.3.0 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index 64fc6abb3b..e6f4e5bc3d 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - AwsAccountId diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 2d23314af0..8cf3fced71 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 9b4849dfc4..5ea501b2a5 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index d33f35db27..3f30e5003c 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 23184c3e12..0d1814a1fb 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index bbbac95edf..1056b51476 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 5328a53ec2..05ae6170ff 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 7d826f5370..9d099b746f 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 8dec124377..bb9c0cdbc0 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 6dd0b04531..8d5fac1a5e 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 1c33eb5297..047ac126b8 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 87b07760be..00f450cc02 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 82caf1ffca..d945db01a4 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 27824f1429..5290f93d7f 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index e3286081b2..8e31d2ba70 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index ad9f821776..9512febc42 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 8824c6cce7..68973cf9bf 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 020e6ab111..11b8c70a60 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index c182874945..f68bb2e219 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 4227fb1143..758efd25fa 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 9cc05a766c..26b38ab885 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 6c79156166..fc2ceb3233 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index caa8c9ca1a..1b8fe4bbad 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 8aa47b20cf..8a57ac3379 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - column - action diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index 1c672354b4..2eba8da408 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -11,5 +11,5 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index 61d0ec4d56..ea89feb797 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - Cisco_ASA_action - Cisco_ASA_message_id diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index 57f78a420b..c230fb1324 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - access_device.browser - access_device.browser_version diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index ba87861cc1..2c18d1907f 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - action - actionlabel diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index 2ed3fe0059..812d0fb4e7 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - _time - app diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index 53b8c8dcd6..09638fe7ac 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - _time - cluster_name diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 82e8b8c3d4..4308ee3d7e 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - _time - app diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index 402fddfdd5..945246997d 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:flowdata:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - action - aliul diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 569f2e8972..2c20615755 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:osquery:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - current_page - date_hour diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index e1ce31ca6d..d3fd410752 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:dns supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.54 + version: 1.0.55 fields: - RecordType - ReplyCode diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index 4faa2e264e..853d99563c 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -10,7 +10,7 @@ sourcetype: cisco:cloud_security:firewall supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.54 + version: 1.0.55 fields: - _time - action diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index 1c96a73ef5..47cd6ad46e 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:proxy supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.54 + version: 1.0.55 fields: - _time - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index 3a199b6f48..5daa5a49a9 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - AC_RuleAction - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index 84d09c5837..5ef3eb6005 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - app - Application diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index db18b5a342..0f5beb9d50 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - Application - Classification diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 2ff079b443..7f538f050d 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -17,7 +17,7 @@ separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.1.2 + version: 3.2.0 fields: - action - description diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index a44d6511ad..8eebac571f 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -18,7 +18,7 @@ separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.1.2 + version: 3.2.0 fields: - AuthenticationId - AuthenticationId_meaning diff --git a/data_sources/github_enterprise_audit_logs.yml b/data_sources/github_enterprise_audit_logs.yml index 266202314d..b95f95aa81 100644 --- a/data_sources/github_enterprise_audit_logs.yml +++ b/data_sources/github_enterprise_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: httpevent supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 4.0.0 + version: 4.0.1 fields: - _document_id - action diff --git a/data_sources/github_organizations_audit_logs.yml b/data_sources/github_organizations_audit_logs.yml index 1a187a6d09..8896f64c89 100644 --- a/data_sources/github_organizations_audit_logs.yml +++ b/data_sources/github_organizations_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: github:cloud:audit supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 4.0.0 + version: 4.0.1 fields: - _document_id - action diff --git a/data_sources/nginx_access.yml b/data_sources/nginx_access.yml index 3b205f3932..670fccc69c 100644 --- a/data_sources/nginx_access.yml +++ b/data_sources/nginx_access.yml @@ -16,7 +16,7 @@ sourcetype: nginx:plus:kv supported_TA: - name: Splunk Add-on for NGINX url: https://splunkbase.splunk.com/app/3258 - version: 3.3.1 + version: 3.3.2 fields: - _time - action From 7b6385a2f27505500c8d18cebca9a83513d33b39 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Fri, 18 Sep 2026 18:52:37 -0400 Subject: [PATCH 104/164] Deprecate macos reopened applications (#4273) Co-authored-by: Nasreddine Bencherchali --- .../macos___re_opened_applications.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) rename detections/{endpoint => deprecated}/macos___re_opened_applications.yml (90%) diff --git a/detections/endpoint/macos___re_opened_applications.yml b/detections/deprecated/macos___re_opened_applications.yml similarity index 90% rename from detections/endpoint/macos___re_opened_applications.yml rename to detections/deprecated/macos___re_opened_applications.yml index b81a9593cc..a2d8614cec 100644 --- a/detections/endpoint/macos___re_opened_applications.yml +++ b/detections/deprecated/macos___re_opened_applications.yml @@ -1,10 +1,10 @@ name: MacOS - Re-opened Applications id: 40bb64f9-f619-4e3d-8732-328d40377c4b -version: 8 +version: 9 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-18' author: Jamie Windley, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic identifies processes referencing plist files that determine which applications are re-opened when a user reboots their MacOS machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes related to "com.apple.loginwindow." This activity is significant because it can indicate attempts to persist across reboots, a common tactic used by attackers to maintain access. If confirmed malicious, this could allow an attacker to execute code or maintain persistence on the affected system, potentially leading to further compromise. data_source: @@ -43,3 +43,7 @@ product: - Splunk Cloud category: endpoint security_domain: threat +deprecation_info: + reason: Detection deprecated as it is targeting a method of persistence that has been disabled in MacOS for years. As well, the fact that the detection has been set to experimental since 2020. + removed_in_version: 6.10.0 + replacement_content: [] From 790ce0a21ba8e1a521e28407216a66037ceb6776 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 21 Sep 2026 13:30:58 +0200 Subject: [PATCH 105/164] Multiple Detections Against Recent ClickFix Campaigns (#4269) --------- Co-authored-by: Nasreddine Bencherchali --- ...finger_exe_connecting_to_a_remote_host.yml | 94 +++++++++++++++ ...age_within_cmd_exe_to_execute_commands.yml | 99 +++++++++++++++ ...xecuting_js_script_in_immediate_folder.yml | 114 ++++++++++++++++++ ...ing_ironlanguages_repository_on_github.yml | 93 ++++++++++++++ 4 files changed, 400 insertions(+) create mode 100644 detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml create mode 100644 detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml create mode 100644 detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml create mode 100644 detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml diff --git a/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml b/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml new file mode 100644 index 0000000000..40b37b5598 --- /dev/null +++ b/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml @@ -0,0 +1,94 @@ +name: Windows Finger.exe Connecting to a Remote Host +id: 86a5686a-7bc4-469c-9f88-2620279ede6e +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic identifies the `finger.exe` utility being spawned with a command line containing an `@` character, indicating a remote host/server was specified. + The Finger protocol utility is largely obsolete in modern environments and has been abused by adversaries as a living-off-the-land binary (LOLBIN) to retrieve encoded payloads or establish covert command-and-control communication with an attacker-controlled finger server. + This behavior is uncommon in legitimate enterprise usage and warrants investigation. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.process_name="finger.exe" + OR + Processes.original_file_name="finger.exe" + ) + Processes.process="*@*" + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_finger_exe_connecting_to_a_remote_host_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are + designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this + search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must + ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons + that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data + model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: No false positives have been identified at this time. +references: + - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader + - https://lolbas-project.github.io/lolbas/Binaries/Finger/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: The [$process_path$] utility was used to connect to a remote host via the Command Line [$process$] from [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process +analytic_story: + - Command And Control + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Windows Post-Exploitation + - Living Off The Land +asset_type: Endpoint +mitre_attack_id: + - T1071 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml new file mode 100644 index 0000000000..a4e9eadf4a --- /dev/null +++ b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml @@ -0,0 +1,99 @@ +name: Windows For Loop Usage Within Cmd.exe To Execute Commands +id: a4ce9079-fc8f-4749-982a-13197c8cf977 +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies the use of a `for /f` loop with the `delims=` option within `cmd.exe`, a technique commonly used to parse and extract data from the output of other commands. + Adversaries and malicious scripts leverage this pattern to programmatically process command output for discovery, data extraction, or execution purposes while evading simpler detection logic. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.parent_process="*for /f*" + Processes.parent_process="*delims=*" + NOT Processes.user="SYSTEM" + NOT Processes.user="*$" + NOT Processes.parent_process IN ( + "*__VIARelease*", + "*:\\Program Files\\Microsoft SQL Server\\*", + "*^| findstr *" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_for_loop_usage_within_cmd_exe_to_execute_commands_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent + is installed. To implement this search, you must ingest logs that contain the process GUID, process + name, and parent process. Additionally, you must ingest complete command-line executions. These logs + must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk + Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrators or power users may use `for /f` loops with `delims=` in legitimate scripts for automation or troubleshooting purposes. +references: + - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The [$process_name$] utility was invoked with a For loop via the Command Line [$process$] on [$dest$]. +threat_objects: + - field: process + type: process + - field: parent_process_name + type: parent_process_name +analytic_story: + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Living Off The Land + - Suspicious Command-Line Executions + - Windows Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml new file mode 100644 index 0000000000..9c9c995c1e --- /dev/null +++ b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml @@ -0,0 +1,114 @@ +name: Windows Node.exe Executing JS Script In Immediate Folder +id: b22af614-2e48-4d43-aea2-93017500ef0c +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic identifies `node.exe` directly executing a single `.js` script located in the same directory it was launched from, where that directory is an unusual location such as a user profile, PerfLogs, ProgramData, or Temp folder. + Legitimate Node.js application, module, and package manager directories are excluded. + This pattern is commonly associated with malware loaders and second-stage payloads that leverage the Node.js runtime to execute JavaScript outside of a typical development or application context. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.process_name="node.exe" + OR + Processes.original_file_name="node.exe" + ) + Processes.process="*js" + Processes.process_path IN ( + "*:\\Users\\*", + "*:\\PerfLogs\\*", + "*:\\ProgramData\\*", + "*:\\Temp\\*") + NOT Processes.process_path IN ( + "*\\AppData\\Local\\*", + "*\\AppData\\Roaming\\*", + "*\\node\\*", + "*\\nodejs\\*", + "*\\nvm\\*" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.process_current_directory Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval process_args=split(process, " ") + | eval script_name=mvindex(process_args, 1) + | eval process_args_count=mvcount(process_args) + | regex script_name="(?i)^[^\\\/]+\.js$" + | where like(process_path, process_current_directory.process_name) AND process_args_count=2 + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_node_exe_executing_js_script_in_immediate_folder_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are + designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this + search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must + ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons + that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate custom Node.js tooling or utility scripts that are intentionally placed and executed from a user profile, PerfLogs, ProgramData, or Temp directory may trigger this analytic. +references: + - https://www.bluevoyant.com/blog/clickfix-to-nodejs-rat + - https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Node.exe executed script [$script_name$] from an unusual directory on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: script_name + type: file_name +analytic_story: + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Windows Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.007 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml b/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml new file mode 100644 index 0000000000..fa994a611a --- /dev/null +++ b/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml @@ -0,0 +1,93 @@ +name: Windows Process Accessing IronLanguages Repository On GitHub +id: bcdc2543-8c33-44c8-a723-5b7b93e06788 +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines. + Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads. + This activity is uncommon in typical enterprise environments outside of software development contexts. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + Processes.process="*/ironlanguages/*" + Processes.process="*github.com*" + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_accessing_ironlanguages_repository_on_github_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + Software developers or DevOps personnel may legitimately clone or download the IronPython repository from GitHub for development purposes. + Filter as needed based on known developer hosts or users in your environment. +references: + - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader + - https://github.com/IronLanguages/ironpython3 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The Process [$process_name$] with the Command Line [$process$] accessed the IronLanguages GitHub repository on [$dest$]. +threat_objects: + - field: process + type: process +analytic_story: + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Ingress Tool Transfer + - Windows Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1105 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From da1d6113045fea587dfa89694dd4971ed70aea1b Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 16:03:16 +0200 Subject: [PATCH 106/164] Add Some Missing Threat Objects & References (#4262) --------- Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- ...os_xe_webui_programmatic_configuration.yml | 9 +-- ...itten_outside_of_the_outlook_directory.yml | 7 +- .../application/esxi_audit_tampering.yml | 36 ++++++++-- .../application/esxi_bulk_vm_termination.yml | 47 ++++++++++-- .../xmrig_driver_loaded.yml | 12 +++- .../creation_of_lsass_dump_with_taskmgr.yml | 38 ++++++---- .../endpoint/suspicious_wevtutil_usage.yml | 11 +-- .../windows_eventlog_cleared_via_wevtutil.yml | 71 ++++++++++++++----- ...outlook_credentials_access_in_registry.yml | 37 ++++++++-- ..._file_creation_in_confluence_directory.yml | 21 ++++-- .../windows_vulnerable_driver_installed.yml | 7 +- ...rmgr_alternate_data_stream_in_temp_dir.yml | 9 ++- detections/network/dns_kerberos_coercion.yml | 7 +- ...ernal_horizontal_port_scan_nmap_top_20.yml | 7 +- ...ftp_authentication_bypass_exploitation.yml | 7 +- ...rushftp_max_simultaneous_users_from_ip.yml | 7 +- ...g4shell_jndi_payload_injection_attempt.yml | 9 ++- ...oad_injection_with_outbound_connection.yml | 12 +++- ...se_screenconnect_authentication_bypass.yml | 9 ++- .../web/plain_http_post_exfiltrated_data.yml | 7 +- .../unusually_long_content_type_length.yml | 9 ++- 21 files changed, 286 insertions(+), 93 deletions(-) rename detections/{endpoint => deprecated}/xmrig_driver_loaded.yml (89%) diff --git a/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml b/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml index 8a22647372..8beac37a15 100644 --- a/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml +++ b/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml @@ -1,13 +1,13 @@ name: Cisco IOS XE WebUI Programmatic Configuration id: f9686576-a23d-4c4d-bfad-a45499dc448a -version: 1 +version: 2 creation_date: '2026-05-19' -modification_date: '2026-05-19' +modification_date: '2026-09-08' author: Nasreddine Bencherchali status: production type: Anomaly description: | - This analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process. + The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process. data_source: - Cisco IOS Logs search: |- @@ -47,7 +47,8 @@ intermediate_findings: - field: user type: user score: 20 - message: User $user$ performed Cisco IOS-XE WebUI programmatic configuration on $dest$. + message: User [$user$] performed Cisco IOS-XE WebUI programmatic configuration on [$dest$] via [$process$] on [$vty$]. +threat_objects: [] analytic_story: - Salt Typhoon asset_type: Network diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index 229731bdff..211609724d 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -1,8 +1,8 @@ name: Email files written outside of the Outlook directory id: 8d52cf03-ba25-4101-aa78-07994aed4f74 -version: 13 +version: 14 creation_date: '2020-04-29' -modification_date: '2026-07-02' +modification_date: '2026-09-08' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -55,6 +55,9 @@ intermediate_findings: type: system score: 20 message: A new email file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$. +threat_objects: + - field: file_path + type: file_path analytic_story: - Collection and Staging asset_type: Endpoint diff --git a/detections/application/esxi_audit_tampering.yml b/detections/application/esxi_audit_tampering.yml index d0936d95ff..269ff72aeb 100644 --- a/detections/application/esxi_audit_tampering.yml +++ b/detections/application/esxi_audit_tampering.yml @@ -1,17 +1,36 @@ name: ESXi Audit Tampering id: c48a155b-2861-417a-813c-220f5272cf01 -version: 5 +version: 6 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP -description: This detection identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. +description: |- + The following analytic identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. + This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` Message="*esxcli system auditrecords*" Message IN ("*remote*","*local*") NOT Message = "*[shell*" | rex field=_raw "Z (?[\w\.]+)\s" | rex field=_raw "[\w+]\]: (?.*)" | rex field=full_command "\[(?.*)]:\s(?.*)" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_audit_tampering_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message="*esxcli system auditrecords*" + Message IN ("*remote*","*local*") + NOT Message = "*[shell*" + + | rex field=_raw "Z (?[\w\.]+)\s" + | rex field=_raw "[\w+]\]: (?.*)" + | rex field=full_command "\[(?.*)]:\s(?.*)" + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user command + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_audit_tampering_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: No false positives have been identified at this time. references: - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823 drilldown_searches: @@ -24,11 +43,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Audit tampering activity on ESXi host $dest$. + title: Audit tampering activity via [$command$] on ESXi host [$dest$]. entity: field: dest type: system score: 50 +threat_objects: + - field: command + type: command analytic_story: - ESXi Post Compromise - Black Basta Ransomware diff --git a/detections/application/esxi_bulk_vm_termination.yml b/detections/application/esxi_bulk_vm_termination.yml index ba4f702548..4f8cd6c99d 100644 --- a/detections/application/esxi_bulk_vm_termination.yml +++ b/detections/application/esxi_bulk_vm_termination.yml @@ -1,17 +1,49 @@ name: ESXi Bulk VM Termination id: cfe094b4-0737-4a33-9d63-e0562ce2b883 -version: 4 +version: 5 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP -description: This detection identifies when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads. +description: |- + The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` | rex field=_raw "\s\[(?[^\]]+)\]:\s(?.+)$" | rex field=_raw "Z (?[\w\.]+)\s.*:\s(?esxcli\s.+)" | eval command=mvappend(esxicli_Command, shell_Command) | where isnotnull(command) | search (command="pkill -9 vmx-*") OR ( command="*esxcli*" AND command="*--format-param*" AND command="*vm process list*" AND command="*awk*" AND command="*esxcli vm process kill*") | stats min(_time) as firstTime max(_time) as lastTime values(_time) as timeStamp values(command) as commands values(user) as user by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_bulk_vm_termination_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message IN ( + "*pkill -9 *" + "*process kill*" + ) + | rex field=_raw "\s\[(?[^\]]+)\]:\s(?.+)$" + | rex field=_raw "Z (?[\w\.]+)\s.*:\s(?esxcli\s.+)" + | eval command=mvappend(esxicli_Command, shell_Command) + | where isnotnull(command) + | search (command="pkill -9 vmx-*") + OR + ( + command="*esxcli*" + command="*--format-param*" + command="*vm process list*" + command="*awk*" + command="*esxcli vm process kill*" + ) + | stats min(_time) as firstTime + max(_time) as lastTime + values(_time) as timeStamp + values(command) as commands + + by dest user + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_bulk_vm_termination_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: No false positives have been identified at this time. +references: + - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/ drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -22,11 +54,12 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Bulk VM termination activity on ESXi host $dest$. + title: Bulk VM termination activity on ESXi host [$dest$]. entity: field: dest type: system score: 50 +threat_objects: [] analytic_story: - ESXi Post Compromise - Black Basta Ransomware diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/deprecated/xmrig_driver_loaded.yml similarity index 89% rename from detections/endpoint/xmrig_driver_loaded.yml rename to detections/deprecated/xmrig_driver_loaded.yml index a6e725500e..efd2ac89a2 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/deprecated/xmrig_driver_loaded.yml @@ -1,10 +1,10 @@ name: XMRIG Driver Loaded id: 90080fa6-a8df-11eb-91e4-acde48001122 -version: 10 +version: 11 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the installation of the XMRIG coinminer driver on a system. It identifies the loading of the `WinRing0x64.sys` driver, commonly associated with XMRIG, by analyzing Sysmon EventCode 6 logs for specific signatures and image loads. This activity is significant because XMRIG is an open-source CPU miner frequently exploited by adversaries to mine cryptocurrency illicitly. If confirmed malicious, this activity could lead to unauthorized resource consumption, degraded system performance, and potential financial loss due to unauthorized cryptocurrency mining. data_source: @@ -49,3 +49,9 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated as it is inacurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0. + removed_in_version: 6.10.0 + replacement_content: + - Windows Vulnerable Driver Installed + - Windows Vulnerable Driver Loaded diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 744a19680f..25294be65c 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -1,24 +1,33 @@ name: Creation of lsass Dump with Taskmgr id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd -version: 14 +version: 15 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-09-21' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. It leverages Sysmon EventID 11 to identify file creation events where the target filename matches *lsass*.dmp. This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords. If confirmed malicious, an attacker could use the lsass dump to extract credentials and escalate privileges, potentially compromising the entire network. +description: |- + The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. + It leverages Sysmon EventID 11 to identify file creation events where the target filename matches *lsass*.dmp. + This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords. data_source: - Sysmon EventID 11 search: |- - `sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp - | stats count min(_time) as firstTime max(_time) as lastTime - BY action dest file_name - file_path process_guid process_id - user_id vendor_product process_name - TargetFilename - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `creation_of_lsass_dump_with_taskmgr_filter` + `sysmon` + EventID=11 + process_name=taskmgr.exe + file_path=*lsass*.dmp + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY action dest + file_name file_path + process_name process_guid process_id + user_id vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `creation_of_lsass_dump_with_taskmgr_filter` how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. references: @@ -35,11 +44,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: $process_name$ was identified on endpoint $dest$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. + title: The process [$process_name$] was identified on endpoint [$dest$] writing [$file_path$] to disk. entity: field: dest type: system score: 50 +threat_objects: + - field: file_path + type: file_path analytic_story: - Credential Dumping - CISA AA22-257A diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 1ac3be2323..bde70a84a0 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -1,8 +1,8 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -version: 21 +version: 22 creation_date: '2019-10-16' -modification_date: '2026-08-23' +modification_date: '2026-09-21' author: David Dorsey, Michael Haag, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -81,7 +81,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ + title: The EventLog was cleared using the [$process_name$] utility with the Command Line [$process$] on [$dest$] by [$user$]. entity: field: user type: user @@ -91,7 +91,10 @@ intermediate_findings: - field: dest type: system score: 50 - message: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ + message: The EventLog was cleared using the [$process_name$] utility with the Command Line [$process$] on [$dest$] by [$user$]. +threat_objects: + - field: process + type: process analytic_story: - Windows Log Manipulation - Ransomware diff --git a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml index be93dd54bb..836c6880c5 100644 --- a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml +++ b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml @@ -1,27 +1,65 @@ name: Windows Eventlog Cleared Via Wevtutil id: fdb829a8-db84-4832-b64b-3e964cd44f01 -version: 7 +version: 8 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-21' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly description: | - The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise. + The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs. + Clearing the event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count values(Processes.process) as process + min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name=wevtutil.exe + Processes.process IN ("* cl *", "*clear-log*") + + ``` + We exclude the following strings to avoid detection overlap and double coverage since they are already covered by the "Suspicious wevtutil Usage" detection. + ``` + NOT Processes.process IN ( + "*/Trace*", + "*AMSI/Debug*", + "*Application*", + "*CiscoSecureEndpoint*", + "*Microsoft-Windows-BitLocker*", + "*Microsoft-Windows-Bits*", + "*Microsoft-Windows-CAPI2*", + "*Microsoft-Windows-Kernel-File*", + "*Microsoft-Windows-Kernel-Process*", + "*Microsoft-Windows-LDAP*", + "*Microsoft-Windows-PowerShell*", + "*Microsoft-Windows-Sysmon*", + "*Microsoft-Windows-TerminalServices-LocalSessionManager*", + "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*", + "*Microsoft-Windows-WMI-Activity*", + "*OpenSSH/*", + "*PowerShellCore/*", + "*Security*", + "*Setup*", + "*System*", + "*Windows Firewall With Advanced Security*", + "*Windows PowerShell*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -44,11 +82,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: Eventlog was cleared using the Wevtutil.exe utility on $dest$ by $user$ - - field: user - type: user - score: 20 - message: Eventlog was cleared using the Wevtutil.exe utility on $dest$ by $user$ + message: The EventLog was cleared using the [$process_name$] utility with the Command Line [$process$] on [$dest$] by [$user$]. +threat_objects: + - field: process + type: process analytic_story: - Windows Log Manipulation - Ransomware diff --git a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml index ccdf81a36d..31d8f46e31 100644 --- a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml +++ b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml @@ -1,15 +1,39 @@ name: Windows Unsecured Outlook Credentials Access In Registry id: 36334123-077d-47a2-b70c-6c7b3cc85049 -version: 14 +version: 15 creation_date: '2024-02-22' -modification_date: '2026-06-25' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry. It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk. +description: |- + The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry. + It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. + This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. + If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*", "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*") AND process_name != *\\outlook.exe | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsecured_outlook_credentials_access_in_registry_filter`' +search: |- + `wineventlog_security` + EventCode=4663 + object_file_path IN ( + "*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*", + "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*" + ) + NOT process_name IN ( + "*\\HxOutlook.exe", + "*\\Outlook.exe" + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by EventCode object_file_name object_file_path + process_name process_path process_id dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_unsecured_outlook_credentials_access_in_registry_filter` how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." known_false_positives: third party software may access this outlook registry. references: @@ -29,7 +53,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A suspicious process $process_name$ accessing outlook credentials registry on $dest$ + message: A suspicious process [$process_name$] accessing outlook credentials registry [$object_file_path$] on [$dest$]. +threat_objects: + - field: process_name + type: process_name analytic_story: - StealC Stealer - Snake Keylogger diff --git a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml index 8d84834fed..bd0469d430 100644 --- a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml +++ b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml @@ -1,13 +1,13 @@ name: Windows Unusual File Creation in Confluence Directory id: aa9d80d9-ed47-44da-aceb-2909ca4dc19e -version: 2 +version: 3 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - Detects executable file formats being created within the Confluence main directory. + The following analytic detects executable file formats being created within the Confluence main directory. This can be indicative of exploitation of the Confluence web services to stage malware. This won't catch adversaries who modify the output location outside the Confluence directory when exploiting. data_source: @@ -32,7 +32,7 @@ search: |- "*.vbs" ) - by Filesystem.dest Filesystem.file_create_time Filesystem.process_path + by Filesystem.dest Filesystem.file_create_time Filesystem.process_path Filesystem.process_name Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.action Filesystem.file_name Filesystem.user Filesystem.vendor_product @@ -40,8 +40,15 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_file_creation_in_confluence_directory_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Some legitimate administrative or development activities may create executable files in the Confluence directory. Review and filter based on approved maintenance processes. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some legitimate administrative or development activities may create executable files in the Confluence directory. + Review and filter based on approved maintenance processes. +references: + - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a + - https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html + - https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/ drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -56,7 +63,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Executable file created under a Confluence path at $file_path$ on $dest$. + message: The process [$process_name$] created an executable file under a Confluence path at [$file_path$] on [$dest$]. threat_objects: - field: file_path type: file_path diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml index e2832a332f..4884e5dd26 100644 --- a/detections/endpoint/windows_vulnerable_driver_installed.yml +++ b/detections/endpoint/windows_vulnerable_driver_installed.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Installed id: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f -version: 10 +version: 11 creation_date: '2020-01-19' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Dean Luxton status: production type: TTP @@ -38,6 +38,9 @@ finding: field: dest type: system score: 50 +threat_objects: + - field: ImagePath + type: file_path analytic_story: - Windows Drivers - Void Manticore diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml index b3ff2e6f63..54fd1c50a9 100644 --- a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml +++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Wermgr Alternate Data Stream in Temp Dir id: 65222e9b-9d0b-4bfe-8da1-199b98e1d44a -version: 1 +version: 2 creation_date: '2026-06-11' -modification_date: '2026-06-11' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -47,7 +47,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A [$process_name$] created a wermgr.exe alternate stream in the temp directory on $dest$ by $user$ + message: The process [$process_name$] owned by [$user$] created a Wermgr.exe alternate data stream in [$file_path$] on [$dest$] +threat_objects: + - field: file_path + type: file_path analytic_story: - RoguePlanet asset_type: Endpoint diff --git a/detections/network/dns_kerberos_coercion.yml b/detections/network/dns_kerberos_coercion.yml index c5ec0f6c16..3b6869045a 100644 --- a/detections/network/dns_kerberos_coercion.yml +++ b/detections/network/dns_kerberos_coercion.yml @@ -1,8 +1,8 @@ name: DNS Kerberos Coercion id: 8551252d-b5b6-4b6e-8a82-51460aeb29a3 -version: 5 +version: 6 creation_date: '2025-11-18' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP @@ -42,6 +42,9 @@ finding: field: src type: system score: 50 +threat_objects: + - field: query + type: dns_query analytic_story: - Compromised Windows Host - Suspicious DNS Traffic diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml index 3e03807d67..800abe5718 100644 --- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml +++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml @@ -1,8 +1,8 @@ name: Internal Horizontal Port Scan NMAP Top 20 id: 3141a041-4f57-4277-9faa-9305ca1f8e5b -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Dean Luxton status: production type: TTP @@ -77,6 +77,9 @@ finding: field: src_ip type: system score: 50 +threat_objects: + - field: src_ip + type: ip_address analytic_story: - Network Discovery - Cisco Secure Firewall Threat Defense Analytics diff --git a/detections/web/crushftp_authentication_bypass_exploitation.yml b/detections/web/crushftp_authentication_bypass_exploitation.yml index f86f476bc0..58545166f2 100644 --- a/detections/web/crushftp_authentication_bypass_exploitation.yml +++ b/detections/web/crushftp_authentication_bypass_exploitation.yml @@ -1,8 +1,8 @@ name: CrushFTP Authentication Bypass Exploitation id: 82eb7f64-d219-4e21-acfe-956de84c1a35 -version: 6 +version: 7 creation_date: '2025-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,9 @@ intermediate_findings: type: system score: 50 message: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $user$ +threat_objects: + - field: process + type: process analytic_story: - CrushFTP Vulnerabilities - Hellcat Ransomware diff --git a/detections/web/crushftp_max_simultaneous_users_from_ip.yml b/detections/web/crushftp_max_simultaneous_users_from_ip.yml index 2417444f99..58f97fc476 100644 --- a/detections/web/crushftp_max_simultaneous_users_from_ip.yml +++ b/detections/web/crushftp_max_simultaneous_users_from_ip.yml @@ -1,8 +1,8 @@ name: CrushFTP Max Simultaneous Users From IP id: 75dfd9f4-ca64-45d0-9422-4bde6d26a59e -version: 5 +version: 6 creation_date: '2025-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: Anomaly @@ -31,6 +31,9 @@ intermediate_findings: type: system score: 20 message: Potential brute force or automated attack against CrushFTP detected from IP $src_ip$ +threat_objects: + - field: src_ip + type: ip_address analytic_story: - CrushFTP Vulnerabilities asset_type: Web Server diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml index a1ea25c3f5..e6c6582a0f 100644 --- a/detections/web/log4shell_jndi_payload_injection_attempt.yml +++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml @@ -1,8 +1,8 @@ name: Log4Shell JNDI Payload Injection Attempt id: c184f12e-5c90-11ec-bf1f-497c9a704a72 -version: 9 +version: 10 creation_date: '2021-12-13' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Jose Hernandez status: production type: Anomaly @@ -38,6 +38,11 @@ intermediate_findings: type: system score: 20 message: CVE-2021-44228 Log4Shell triggered for host $dest$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Log4Shell CVE-2021-44228 - CISA AA22-257A diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml index bfe6480c26..7f04588142 100644 --- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml +++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml @@ -1,13 +1,14 @@ name: Log4Shell JNDI Payload Injection with Outbound Connection id: 69afee44-5c91-11ec-bf1f-497c9a704a72 -version: 9 +version: 10 creation_date: '2021-12-13' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Jose Hernandez status: production type: Anomaly description: The following analytic detects Log4Shell JNDI payload injections via outbound connections. It identifies suspicious LDAP lookup functions in web logs, such as `${jndi:ldap://PAYLOAD_INJECTED}`, and correlates them with network traffic to known malicious IP addresses. This detection leverages the Web and Network_Traffic data models in Splunk. Monitoring this activity is crucial as it targets vulnerabilities in Java web applications using log4j, potentially leading to remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise sensitive data within the affected environment. -data_source: [] +data_source: + - Splunk Stream IP search: |- | from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)(?\w+)(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?[a-zA-Z0-9\.\-\_\$]+)" | join affected_host type=inner [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename dest AS affected_host] @@ -37,6 +38,11 @@ intermediate_findings: type: system score: 20 message: CVE-2021-44228 Log4Shell triggered for host $dest$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Log4Shell CVE-2021-44228 - CISA AA22-320A diff --git a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml index 154858839f..bae64a63da 100644 --- a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml +++ b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml @@ -1,8 +1,8 @@ name: Nginx ConnectWise ScreenConnect Authentication Bypass id: b3f7a803-e802-448b-8eb2-e796b223bccc -version: 11 +version: 12 creation_date: '2024-02-22' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: TTP @@ -41,6 +41,11 @@ finding: field: dest type: system score: 50 +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - ConnectWise ScreenConnect Vulnerabilities - Seashell Blizzard diff --git a/detections/web/plain_http_post_exfiltrated_data.yml b/detections/web/plain_http_post_exfiltrated_data.yml index e6432c5fff..4a01f10787 100644 --- a/detections/web/plain_http_post_exfiltrated_data.yml +++ b/detections/web/plain_http_post_exfiltrated_data.yml @@ -1,8 +1,8 @@ name: Plain HTTP POST Exfiltrated Data id: e2b36208-a364-11eb-8909-acde48001122 -version: 13 +version: 14 creation_date: '2021-04-22' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: TTP @@ -37,6 +37,9 @@ finding: field: src_ip type: system score: 50 +threat_objects: + - field: dest_ip + type: ip_address analytic_story: - Data Exfiltration - Command And Control diff --git a/detections/web/unusually_long_content_type_length.yml b/detections/web/unusually_long_content_type_length.yml index f5b0a3f1ed..d7975e1a33 100644 --- a/detections/web/unusually_long_content_type_length.yml +++ b/detections/web/unusually_long_content_type_length.yml @@ -1,8 +1,8 @@ name: Unusually Long Content-Type Length id: 57a0a2bf-353f-40c1-84dc-29293f3c35b7 -version: 7 +version: 8 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Bhavin Patel, Splunk status: experimental type: Anomaly @@ -29,6 +29,11 @@ intermediate_findings: type: system score: 20 message: Unusually Long Content-Type Length ($http_content_type_length$ characters) In Web Request from $src$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Apache Struts Vulnerability asset_type: Web Server From 4ad49471064677a5a763130bd5c303379428f3aa Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 16:05:20 +0200 Subject: [PATCH 107/164] Update EventID 10 Analytics (#4276) --- data_sources/sysmon_eventid_10.yml | 6 +- ...windows_process_injection_into_notepad.yml | 11 +++- ...redential_dumping_through_lsass_access.yml | 64 ++++++++++++------ ...ticket_exports_through_winlogon_access.yml | 55 +++++++++++++--- ...lation_winlogon_duplicate_token_handle.yml | 53 +++++++++++++-- ...ogon_duplicate_handle_in_uncommon_path.yml | 51 +++++++++++++-- ...plication_in_known_uac_bypass_binaries.yml | 56 ++++++++++++++-- .../windows_possible_credential_dumping.yml | 65 ++++++++++++++----- ...jection_into_commonly_abused_processes.yml | 53 ++++++++------- .../windows_terminating_lsass_process.yml | 52 +++++++++------ .../windows_wmi_impersonate_token.yml | 51 +++++++++++++-- 11 files changed, 398 insertions(+), 119 deletions(-) rename detections/{endpoint => deprecated}/windows_process_injection_into_notepad.yml (92%) diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index d1ba331c5b..7c13a96041 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 10 id: 659cd5a8-148a-4c59-ade1-05f41ac1b096 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-09-21' author: Patrick Bareiss, Splunk description: Logs events where one process accesses another process, typically for memory reads or injections, including details about the source and target processes. mitre_components: @@ -101,8 +101,6 @@ fields: output_fields: - dest - user_id - - parent_process_name - - parent_process_guid - process_name - process_guid - process_id diff --git a/detections/endpoint/windows_process_injection_into_notepad.yml b/detections/deprecated/windows_process_injection_into_notepad.yml similarity index 92% rename from detections/endpoint/windows_process_injection_into_notepad.yml rename to detections/deprecated/windows_process_injection_into_notepad.yml index 07b256cded..d4869ca37b 100644 --- a/detections/endpoint/windows_process_injection_into_notepad.yml +++ b/detections/deprecated/windows_process_injection_into_notepad.yml @@ -1,10 +1,10 @@ name: Windows Process Injection into Notepad id: b8340d0f-ba48-4391-bea7-9e793c5aae36 -version: 13 +version: 14 creation_date: '2023-02-24' -modification_date: '2026-05-13' +modification_date: '2026-09-21' author: Michael Haag, Splunk -status: production +status: deprecated type: Anomaly description: The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. data_source: @@ -55,3 +55,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated as it is already covered by the" Windows Process Injection into Commonly Abused Processes" detection. + removed_in_version: 6.10.0 + replacement_content: + - Windows Process Injection into Commonly Abused Processes diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index e2a9be602f..975c102a40 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -1,33 +1,54 @@ name: Detect Credential Dumping through LSASS access id: 2c365e57-4414-4540-8dc0-73ab10729996 -version: 15 +version: 16 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Patrick Bareiss, Splunk status: production type: TTP -description: The following analytic detects attempts to read LSASS memory, indicative of credential dumping. It leverages Sysmon EventCode 10, filtering for specific access permissions (0x1010 and 0x1410) on the lsass.exe process. This activity is significant because it suggests an attacker is trying to extract credentials from LSASS memory, potentially leading to unauthorized access, data breaches, and compromise of sensitive information. If confirmed malicious, this could enable attackers to escalate privileges, move laterally within the network, or exfiltrate data. Extensive triage is necessary to differentiate between malicious and benign activities. +description: |- + The following analytic detects attempts to read LSASS memory, indicative of credential dumping. + It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe. data_source: - Sysmon EventID 10 search: |- - `sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) - | stats count min(_time) as firstTime max(_time) as lastTime - BY CallTrace EventID GrantedAccess - Guid Opcode ProcessID - SecurityID SourceImage SourceProcessGUID - SourceProcessId TargetImage TargetProcessGUID - TargetProcessId UserID dest - granted_access parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process_exec process_guid process_id - process_name process_path signature - signature_id user_id vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_credential_dumping_through_lsass_access_filter` + `sysmon` + EventCode=10 + TargetImage="*\\lsass.exe" + + ``` + Convert GrantedAccess from hexadecimal to decimal. + Match "PROCESS_VM_READ" with either "PROCESS_QUERY_LIMITED_INFORMATION" or "PROCESS_QUERY_INFORMATION", which represent the either the "0x1010" or "0x1410" hexadecimal masks. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_VM_READ = 16 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval PROCESS_QUERY_INFORMATION = 1024 + | eval vm_read_set = bit_and(g_access_decimal, PROCESS_VM_READ) + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | eval query_information_set = bit_and(g_access_decimal, PROCESS_QUERY_INFORMATION) + | where vm_read_set == PROCESS_VM_READ + AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + AND (query_information_set == 0 OR query_information_set == PROCESS_QUERY_INFORMATION) + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_credential_dumping_through_lsass_access_filter` how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise. -references: [] +references: + - https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/ + - https://attack.mitre.org/techniques/T1003/001/ drilldown_searches: - name: View the detection results for - "$dest$" and "$TargetImage$" search: '%original_detection_search% | search dest = "$dest$" TargetImage = "$TargetImage$"' @@ -38,11 +59,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: The $SourceImage$ has attempted access to read $TargetImage$ was identified on endpoint $dest$, this is indicative of credential dumping and should be investigated. + title: The process [$SourceImage$] requested read access via the access mask [$granted_access$] to [$TargetImage$] on [$dest$], which may indicate credential dumping. entity: field: dest type: system score: 50 +threat_objects: + - field: SourceImage + type: file_path analytic_story: - Detect Zerologon Attack - CISA AA23-347A diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 8b18aec0c0..28850f03f5 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -1,17 +1,54 @@ name: Rubeus Kerberos Ticket Exports Through Winlogon Access id: 5ed8c50a-8869-11ec-876f-acde48001122 -version: 14 +version: 15 creation_date: '2022-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects a process accessing the winlogon.exe system process, indicative of the Rubeus tool attempting to export Kerberos tickets from memory. This detection leverages Sysmon EventCode 10 logs, focusing on processes obtaining a handle to winlogon.exe with specific access rights. This activity is significant as it often precedes pass-the-ticket attacks, where adversaries use stolen Kerberos tickets to move laterally within an environment. If confirmed malicious, this could allow attackers to bypass normal access controls, escalate privileges, and persist within the network, posing a severe security risk. +description: |- + The following analytic detects an uncommon process requesting full access rights to winlogon.exe, which may indicate Rubeus exporting Kerberos tickets from memory. + It leverages Sysmon EventCode 10 and checks for full-access rights, specifically the value 0x1f3fff. data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff) (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`' -how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. -known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed +search: |- + `sysmon` + EventCode=10 + TargetImage="*:\\Windows\\system32\\winlogon.exe" + NOT SourceImage IN ( + "C:\\Windows\\system32\\LogonUI.exe", + "C:\\Windows\\system32\\lsass.exe", + "C:\\Windows\\system32\\smss.exe", + "C:\\Windows\\system32\\svchost.exe", + "C:\\Windows\\system32\\wbem\\wmiprvse.exe" + ) + + ``` + Convert GrantedAccess from hexadecimal to decimal. 0x1f3fff is the legacy full-access mask observed for this activity. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_ALL_ACCESS_LEGACY = 2047999 + | eval legacy_full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS_LEGACY) + | where legacy_full_access_set == PROCESS_ALL_ACCESS_LEGACY + + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter` +how_to_implement: |- + This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. +known_false_positives: |- + No false positives have been identified at this time. references: - https://github.com/GhostPack/Rubeus - https://web.archive.org/web/20210725005734/http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ @@ -26,14 +63,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Winlogon.exe was accessed by $SourceImage$ on $dest$ + title: The process [$SourceImage$] requested full access via the access mask [$granted_access$] to [$TargetImage$] on [$dest$]. entity: field: dest type: system score: 50 threat_objects: - - field: TargetImage - type: process + - field: SourceImage + type: file_path analytic_story: - CISA AA23-347A - Active Directory Kerberos Attacks diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml index fee41b3ad0..b29ba78c19 100644 --- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml +++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml @@ -1,17 +1,58 @@ name: Windows Access Token Manipulation Winlogon Duplicate Token Handle id: dda126d7-1d99-4f0b-b72a-4c14031f9398 -version: 9 +version: 10 creation_date: '2022-09-01' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic detects a process attempting to access winlogon.exe to duplicate its handle. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights. This activity is significant because it is a common technique used by adversaries to escalate privileges by leveraging the high privileges and security tokens associated with winlogon.exe. If confirmed malicious, this could allow an attacker to gain elevated privileges, potentially leading to full system compromise and unauthorized access to sensitive information. +description: |- + The following analytic detects a process requesting duplicate-handle and query-limited-information access to winlogon.exe. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed. +search: |- + `sysmon` + EventCode=10 + TargetImage="*:\\Windows\\system32\\winlogon.exe" + + NOT SourceImage IN ( + "C:\\Windows\\system32\\LogonUI.exe", + "C:\\Windows\\system32\\lsass.exe", + "C:\\Windows\\system32\\smss.exe", + "C:\\Windows\\system32\\svchost.exe", + "C:\\Windows\\system32\\wbem\\wmiprvse.exe" + ) + + ``` + Convert GrantedAccess from hexadecimal to decimal. + 0x1040 combines PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | where duplicate_handle_set == PROCESS_DUP_HANDLE + AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter` +how_to_implement: |- + To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: |- + It is possible legitimate applications will request access to winlogon, filter as needed. references: - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle - https://attack.mitre.org/techniques/T1134/001/ diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml index a0e87a811c..c6f811f2d9 100644 --- a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml +++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml @@ -1,16 +1,53 @@ name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path id: b8f7ed6b-0556-4c84-bffd-839c262b0278 -version: 12 +version: 13 creation_date: '2022-09-01' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects a process attempting to duplicate the handle of winlogon.exe from an uncommon or public source path. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights and excluding common system paths. This activity is significant because it may indicate an adversary trying to escalate privileges by leveraging the high-privilege tokens associated with winlogon.exe. If confirmed malicious, this could allow the attacker to gain elevated access, potentially leading to full system compromise and persistent control over the affected host. +description: |- + The following analytic detects duplicate-handle and query-limited-information access to winlogon.exe from an uncommon or public source path. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040 AND NOT (SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +search: |- + `sysmon` + EventCode=10 + TargetImage="*:\\Windows\\System32\\winlogon.exe" + NOT SourceImage IN ( + "%SystemRoot%\\*", + "C:\\Program Files (x86)\\*", + "C:\\Program Files\\*", + "C:\\Windows\\*" + ) + + ``` + Convert GrantedAccess from hexadecimal to decimal. 0x1040 combines PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | where duplicate_handle_set == PROCESS_DUP_HANDLE + AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter` +how_to_implement: |- + To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed. references: - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle @@ -29,10 +66,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process $SourceImage$ is duplicating the handle token of winlogon.exe on $dest$ + message: The process [$SourceImage$] requested duplicate-handle access [$granted_access$] to [$TargetImage$] on [$dest$] threat_objects: - field: SourceImage - type: process_name + type: file_path analytic_story: - Brute Ratel C4 - PathWiper diff --git a/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml b/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml index f0d086a2eb..051bcd7b7b 100644 --- a/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml +++ b/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml @@ -1,15 +1,57 @@ name: Windows Handle Duplication in Known UAC-Bypass Binaries id: d7369bf5-1315-4138-b927-2dd8bb8c1da7 -version: 4 +version: 5 creation_date: '2025-11-07' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious handle duplication activity targeting known Windows utilities such as ComputerDefaults.exe, Eventvwr.exe, and others. This technique is commonly used to escalate privileges or bypass UAC by inheriting or injecting elevated tokens or handles. The detection focuses on non-standard use of DuplicateHandle or token duplication where process, thread, or token handles are copied into the context of trusted, signed utilities. Such behavior may indicate attempts to execute with elevated rights without user consent. Alerts enable rapid triage using process trees, handle data, token attributes, command-lines, and binary hashes. +description: |- + The following analytic detects duplicate-handle access to known UAC-bypass binaries from a non-standard source path. + It leverages Sysmon EventCode 10, converts GrantedAccess from hexadecimal, and checks for PROCESS_DUP_HANDLE. data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage IN("*\\ComputerDefaults.exe", "*\\eventvwr.exe*", "*\\fodhelper.exe","*\\slui.exe","*\\sdclt.exe","*\\mmc.exe", "*\\colorcpl.exe","*\\wsreset.exe","*\\esentutl.exe", "*\PkgMgr.exe") AND NOT (SourceImage IN ("*C:\\Windows\\system32\\*","*C:\\Windows\\syswow64\\*","*C:\\Program Files\\*", "*C:\\Program Files (x86)\\*","%systemroot%\\*")) | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) | eval PROCESS_DUP_HANDLE = 64 | eval dup_handle_set = bit_and (g_access_decimal, PROCESS_DUP_HANDLE) | where dup_handle_set == PROCESS_DUP_HANDLE | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage GrantedAccess PROCESS_DUP_HANDLE g_access_decimal dup_handle_set Guid Opcode ProcessID SecurityID SourceProcessGUID SourceProcessId TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product CallTrace EventID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_handle_duplication_in_known_uac_bypass_binaries_filter`' +search: |- + `sysmon` + EventCode=10 + TargetImage IN( + "*\\colorcpl.exe", + "*\\ComputerDefaults.exe", + "*\\esentutl.exe", + "*\\eventvwr.exe", + "*\\fodhelper.exe", + "*\\mmc.exe", + "*\\sdclt.exe", + "*\\slui.exe", + "*\\wsreset.exe", + "*\\PkgMgr.exe" + ) + NOT SourceImage IN ( + "C:\\Windows\\System32\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Program Files\\*", + "C:\\Program Files (x86)\\*", + "%SystemRoot%\\*" + ) + + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval dup_handle_set = bit_and (g_access_decimal, PROCESS_DUP_HANDLE) + | where dup_handle_set == PROCESS_DUP_HANDLE + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_handle_duplication_in_known_uac_bypass_binaries_filter` how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: It is possible legitimate applications will request access to list of know abused Windows UAC binaries process, filter as needed. references: @@ -28,10 +70,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process $SourceImage$ is duplicating the handle token of $TargetImage$ on $dest$ + message: The process [$SourceImage$] requested duplicate-handle access [$granted_access$] to [$TargetImage$] on [$dest$] threat_objects: - - field: parent_process_name - type: parent_process_name + - field: SourceImage + type: file_path analytic_story: - Castle RAT asset_type: Endpoint diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index 2b3d0e2ab1..9d8d8f1839 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -1,17 +1,58 @@ name: Windows Possible Credential Dumping id: e4723b92-7266-11ec-af45-acde48001122 -version: 14 +version: 15 creation_date: '2022-01-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production -type: TTP -description: The following analytic detects potential credential dumping by identifying specific GrantedAccess permission requests and CallTrace DLLs targeting the LSASS process. It leverages Sysmon EventCode 10 logs, focusing on access requests to lsass.exe and call traces involving debug and native API DLLs like dbgcore.dll, dbghelp.dll, and ntdll.dll. This activity is significant as credential dumping can lead to unauthorized access to sensitive credentials. If confirmed malicious, attackers could gain elevated privileges and persist within the environment, posing a severe security risk. +type: Anomaly +description: |- + The following analytic detects possible credential dumping by identifying suspicious process access to LSASS with credential-dumping-related call traces. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe granted_access IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*", "*kernelbase.dll*", "*kernel32.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`' +search: |- + `sysmon` + EventCode=10 + TargetImage=*\\lsass.exe + CallTrace IN ( + "*dbgcore.dll*", + "*dbghelp.dll*", + "*kernel32.dll*", + "*kernelbase.dll*", + "*ntdll.dll*" + ) + NOT SourceUser IN ( + "NT AUTHORITY\\SYSTEM", + "NT AUTHORITY\\NETWORK SERVICE" + ) + + ``` + We looking for a value of PROCESS_QUERY_LIMITED_INFORMATION (0x1000) or PROCESS_DUP_HANDLE (0x40). + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval PROCESS_DUP_HANDLE = 64 + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | where query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + OR duplicate_handle_set == PROCESS_DUP_HANDLE + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_possible_credential_dumping_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required. -known_false_positives: False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught. +known_false_positives: False positives will occur when legitimate tools request query-limited or duplicate-handle access to LSASS. Filter based on source image as needed. Cobalt Strike usage of Mimikatz may generate this activity. references: - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump @@ -28,21 +69,15 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A process, $SourceImage$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details. - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A process, $SourceImage$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details. + score: 20 + message: The process [$SourceImage$] requested suspicious access mask [$granted_access$] to [$TargetImage$] on [$dest$], which may indicate credential dumping. threat_objects: - field: SourceImage - type: process + type: file_path analytic_story: - Detect Zerologon Attack - CISA AA22-264A diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml index a9958f0f9d..0883c32e6b 100644 --- a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml +++ b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml @@ -1,12 +1,16 @@ name: Windows Process Injection into Commonly Abused Processes id: 1e1dedc6-f6f3-41a0-9dd7-a1245904fe75 -version: 8 +version: 9 creation_date: '2023-02-24' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: 0xC0FFEEEE, Github Community status: production type: Anomaly -description: The following analytic detects process injection into executables that are commonly abused using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. +description: |- + The following analytic detects potential process injection attempts into executables that are commonly abused leveraging Sysmon EventCode 10. + It identifies Access Mask requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files. + This activity was associated with the SliverC2 framework by BishopFox. + Monitoring this activity may indicate an initial payload attempting to execute malicious code. data_source: - Sysmon EventID 10 search: |- @@ -16,11 +20,7 @@ search: |- "*\\backgroundtaskhost.exe", "*\\calc.exe", "*\\CalculatorApp.exe", - "*\\chrome.exe", "*\\dllhost.exe", - "*\\edge.exe", - "*\\firefox.exe", - "*\\lsass.exe", "*\\mspaint.exe", "*\\notepad.exe", "*\\regsvr32.exe", @@ -40,23 +40,32 @@ search: |- "*:\\Windows\\SysWOW64\\*" ) - GrantedAccess IN ( - "0x1f3fff", - "0x1fffff", - "0x40" - ) + ``` + Convert GrantedAccess from hexadecimal to decimal. The original access values represent PROCESS_DUP_HANDLE, modern full process access, and legacy full process access. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval PROCESS_ALL_ACCESS = 2097151 + | eval PROCESS_ALL_ACCESS_LEGACY = 2047999 + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | eval full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS) + | eval legacy_full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS_LEGACY) + | where duplicate_handle_set == PROCESS_DUP_HANDLE + OR full_access_set == PROCESS_ALL_ACCESS + OR legacy_full_access_set == PROCESS_ALL_ACCESS_LEGACY - | stats values(user) as user - min(_time) as firstTime - max(_time) as lastTime count - by dest user_id parent_process_name parent_process_guid - process_name process_guid process_id signature SourceImage - TargetImage GrantedAccess CallTrace + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product | eval CallTrace=split(CallTrace, "|") + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table firstTime lastTime dest user_id parent_process_name parent_process_guid process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace | `windows_process_injection_into_commonly_abused_processes_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: False positives may be present based on SourceImage paths, particularly those with a legitimate reason for accessing lsass.exe or regsvr32.exe. If removing the paths is important, realize svchost and many native binaries inject into processes consistently. Restrict or tune as needed. @@ -78,12 +87,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: An instance of $SourceImage$ injecting into $TargetImage$ was identified on endpoint $dest$. + message: The process [$SourceImage$] requested a potentially malicious process injection related access mask [$granted_access$] to [$TargetImage$] on [$dest$]. threat_objects: - field: SourceImage - type: process - - field: TargetImage - type: process + type: file_path analytic_story: - BishopFox Sliver Adversary Emulation Framework - Earth Alux diff --git a/detections/endpoint/windows_terminating_lsass_process.yml b/detections/endpoint/windows_terminating_lsass_process.yml index 1dc7294e2e..94b634ef68 100644 --- a/detections/endpoint/windows_terminating_lsass_process.yml +++ b/detections/endpoint/windows_terminating_lsass_process.yml @@ -1,30 +1,42 @@ name: Windows Terminating Lsass Process id: 7ab3c319-a4e7-4211-9e8c-40a049d0dba6 -version: 15 +version: 16 creation_date: '2022-03-28' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects a suspicious process attempting to terminate the Lsass.exe process. It leverages Sysmon EventCode 10 logs to identify processes granted PROCESS_TERMINATE access to Lsass.exe. This activity is significant because Lsass.exe is a critical process responsible for enforcing security policies and handling user credentials. If confirmed malicious, this behavior could indicate an attempt to perform credential dumping, privilege escalation, or evasion of security policies, potentially leading to unauthorized access and persistence within the environment. +description: |- + The following analytic detects a process requesting PROCESS_TERMINATE access to Lsass.exe. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_TERMINATE (0x1). data_source: - Sysmon EventID 10 search: |- - `sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess = 0x1 - | stats count min(_time) as firstTime max(_time) as lastTime - BY CallTrace EventID GrantedAccess - Guid Opcode ProcessID - SecurityID SourceImage SourceProcessGUID - SourceProcessId TargetImage TargetProcessGUID - TargetProcessId UserID dest - granted_access parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process_exec process_guid process_id - process_name process_path signature - signature_id user_id vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_terminating_lsass_process_filter` + `sysmon` + EventCode=10 + TargetImage="*\\lsass.exe" + + ``` + PROCESS_TERMINATE is 0x1. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_TERMINATE = 1 + | eval terminate_set = bit_and(g_access_decimal, PROCESS_TERMINATE) + | where terminate_set == PROCESS_TERMINATE + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_terminating_lsass_process_filter` how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: No false positives have been identified at this time. references: @@ -43,10 +55,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: a process $SourceImage$ terminates Lsass process on $dest$ + message: A process [$SourceImage$] requested PROCESS_TERMINATE access [$granted_access$] to Lsass.exe on [$dest$]. threat_objects: - field: TargetImage - type: process + type: file_path analytic_story: - Data Destruction - Double Zero Destructor diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 014c341e64..5c9648a1bb 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -1,15 +1,53 @@ name: Windows WMI Impersonate Token id: cf192860-2d94-40db-9a51-c04a2e8a8f8b -version: 10 +version: 11 creation_date: '2022-10-26' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects potential WMI token impersonation activities in a process or command. It leverages Sysmon EventCode 10 to identify instances where `wmiprvse.exe` has a duplicate handle or full granted access in a target process. This behavior is significant as it is commonly used by malware like Qakbot for privilege escalation or defense evasion. If confirmed malicious, this activity could allow an attacker to gain elevated privileges, evade defenses, and maintain persistence within the environment. +description: |- + The following analytic detects WMI token impersonation by identifying `wmiprvse.exe` requesting the query, VM, and duplicate-handle rights associated with WMI process access. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_INFORMATION (0x400), PROCESS_QUERY_LIMITED_INFORMATION (0x1000), PROCESS_VM_OPERATION (0x8), PROCESS_VM_READ (0x10), PROCESS_VM_WRITE (0x20), PROCESS_DUP_HANDLE (0x40), and PROCESS_ALL_ACCESS (0x1f3fff). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN ("0x1478", "0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_impersonate_token_filter`' +search: |- + `sysmon` + EventCode=10 + SourceImage="*\\wmiprvse.exe" + + ``` + The 0x1478 mask combines query, VM, and duplicate-handle rights; + The 0x1fffff mas is full process access. + Additional requested rights are allowed. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_QUERY_INFORMATION = 1024 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval PROCESS_VM_OPERATION = 8 + | eval PROCESS_VM_READ = 16 + | eval PROCESS_VM_WRITE = 32 + | eval PROCESS_DUP_HANDLE = 64 + | eval WMI_REQUIRED_ACCESS = PROCESS_QUERY_INFORMATION + PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_VM_OPERATION + PROCESS_VM_READ + PROCESS_VM_WRITE + PROCESS_DUP_HANDLE + | eval PROCESS_ALL_ACCESS = 2097151 + | eval wmi_access_set = bit_and(g_access_decimal, WMI_REQUIRED_ACCESS) + | eval full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS) + | where wmi_access_set == WMI_REQUIRED_ACCESS + OR full_access_set == PROCESS_ALL_ACCESS + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_wmi_impersonate_token_filter` how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: administrator may execute impersonate wmi object script for auditing. Filter is needed. references: @@ -29,7 +67,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ to $TargetImage$ process on $dest$ + message: The [$SourceImage$] requested the access mask [$granted_access$] from [$TargetImage$] on [$dest$]. This may indicate WMI token impersonation. +threat_objects: + - field: SourceImage + type: file_path analytic_story: - Qakbot - Water Gamayun From 0389108b78d31725ea28059b261ccfde4245b508 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 21 Sep 2026 16:31:35 +0200 Subject: [PATCH 108/164] macOS detection: MacOS Osascript Executing Interactive Shell (#4271) --------- Co-authored-by: onurmerdogan Co-authored-by: Nasreddine Bencherchali --- ..._osascript_executing_interactive_shell.yml | 86 +++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 detections/endpoint/macos_osascript_executing_interactive_shell.yml diff --git a/detections/endpoint/macos_osascript_executing_interactive_shell.yml b/detections/endpoint/macos_osascript_executing_interactive_shell.yml new file mode 100644 index 0000000000..c308ce8fc1 --- /dev/null +++ b/detections/endpoint/macos_osascript_executing_interactive_shell.yml @@ -0,0 +1,86 @@ +name: MacOS Osascript Executing Interactive Shell +id: 01168215-d1c7-4a37-8bd3-c5b64664c947 +version: 1 +creation_date: '2026-09-18' +modification_date: '2026-09-18' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + This analytic detects the macOS osascript utility being used with an interactive Bash invocation, identified by the presence + of "bash -i" in the command line. + Adversaries may abuse osascript and AppleScript's shell execution capabilities to launch + interactive shells, establish remote access, or execute post-exploitation commands. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name="osascript" + Processes.process="*bash *" + Processes.process="* -i*" + + BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_osascript_executing_interactive_shell_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative scripts, MDM workflows, software deployment tools, developer automation, or support utilities may use osascript to invoke an interactive shell. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://attack.mitre.org/techniques/T1059/004/ + - https://redcanary.com/threat-detection-report/techniques/applescript/ + - https://www.loobins.io/binaries/osascript/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The Osascript utility with the command line [$process$] was observed on [$dest$] executing an interactive Bash command line. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log + source: osquery + sourcetype: osquery:results + test_type: unit From 840306f240c78b68682629d297f3561efaa6ff03 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 21 Sep 2026 16:33:25 +0200 Subject: [PATCH 109/164] macOS detection: Osascript Long Lived Connection To Remote Host (#4270) --------- Co-authored-by: onurmerdogan Co-authored-by: Nasreddine Bencherchali --- ...network_connection_for_a_long_duration.yml | 104 ++++++++++++++++++ 1 file changed, 104 insertions(+) create mode 100644 detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml new file mode 100644 index 0000000000..b2215aab9f --- /dev/null +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -0,0 +1,104 @@ +name: Cisco NVM - Osascript Network Connection for a Long Duration +id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 +version: 1 +creation_date: '2026-09-18' +modification_date: '2026-09-18' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). + Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections. +data_source: + - Cisco Network Visibility Module Flow Data +search: |- + `cisco_network_visibility_module_flowdata` + ( + parent_process_name="osascript" + OR + process_name="osascript" + ) + + ``` + FSS stands for Flow Start Seconds + FES stands for Flow End Seconds + ``` + | eval duration=fes-fss + + | where duration>600 + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_hash) as parent_process_hash + values(process_hash) as process_hash + values(dest_port) as dest_port + values(dest_hostname) as dest_hostname + values(http_method) as http_method + by src dest transport parent_process_path parent_process_name + parent_process parent_process_id process_path process_name + process process_id user duration + + | eval duration=tostring(duration)." seconds" + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `cisco_nvm___osascript_network_connection_for_a_long_duration_filter` +how_to_implement: |- + This search requires Network Visibility Module logs, which includes the flow data sourcetype. + This search uses an input macro named `cisco_network_visibility_module_flowdata`. + We strongly recommend that you specify your environment-specific configurations + (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + Replace the macro definition with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. + The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). +known_false_positives: |- + Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/tactics/TA0011/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://attack.mitre.org/techniques/T1071/001/ + - https://www.loobins.io/binaries/osascript/ +drilldown_searches: + - name: View detection results for "$src$" and "$dest$" + search: '%original_detection_search% | search src="$src$" dest="$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for "$src$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: The macOS host [$src$] used the Osascript utility with the command line [$process$] and a parent process [$parent_process_name$] to initiate a network connection to [$dest$] lasting [$duration$] minutes. +threat_objects: + - field: parent_process_name + type: process_name + - field: process_name + type: process_name + - field: dest + type: ip_address +analytic_story: + - Command And Control + - Cisco Network Visibility Module Analytics + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1071.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log + source: not_applicable + sourcetype: cisco:nvm:flowdata:v2 + test_type: unit From 8fb56503f76fc2b903c0bc484e17f1f9caf74662 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 21 Sep 2026 16:34:56 +0200 Subject: [PATCH 110/164] macOS detection: Osascript Executing JavaScript Code With Objective-C (#4272) --------- Co-authored-by: onurmerdogan Co-authored-by: Nasreddine Bencherchali --- ...pt_executing_javascript_code_with_objc.yml | 86 +++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml diff --git a/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml new file mode 100644 index 0000000000..370282b170 --- /dev/null +++ b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml @@ -0,0 +1,86 @@ +name: MacOS Osascript Executing JavaScript Code With ObjC +id: 9ad44dce-7291-47f8-84a7-e343a5147242 +version: 1 +creation_date: '2026-09-18' +modification_date: '2026-09-18' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + This analytic detects the macOS osascript utility executing JavaScript for Automation (JXA) code, identified by + the "-l JavaScript" interpreter flag, with references to the Objective-C bridge. Adversaries may abuse JXA and + Objective-C APIs to interact with macOS applications, access native system functionality, execute commands, or + perform post-exploitation activity. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name="osascript" + Processes.process="*-l *" + Processes.process="* JavaScript*" + Processes.process="*ObjC.*" + + BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_osascript_executing_javascript_code_with_objc_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Scripts that legitimately invoke utility Osascript with JavaScript for automation or system management. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://attack.mitre.org/techniques/T1059/007/ + - https://www.loobins.io/binaries/osascript/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 30 + message: The Osascript utility with the command line [$process$] was observed on [$dest$] executing JXA code with Objective-C bridge references. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1059.007 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log + source: osquery + sourcetype: osquery:results + test_type: unit From a45339f1bb0d535ac8f679d77b04eb320e8f5bb3 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 17:01:24 +0200 Subject: [PATCH 111/164] Bump contentctl.yml and build.yml to 6.7.0 (#4277) * Update build.yml * Update contentctl.yml --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index b3a9aac053..c3377966ae 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.6.0 +app_version: 6.7.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index 116199c358..1ffa66afde 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.6.0 + version: 6.7.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 1f178cb752c6a23893b82993e5d974d472d868a2 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 18:12:17 +0200 Subject: [PATCH 112/164] Tune and Add More Context to Noisy Detections (#4263) --- .../windows_event_log_security_4740.yml | 97 +++++++++++++++++++ ...network_connection_for_a_long_duration.yml | 2 +- ...detect_excessive_user_account_lockouts.yml | 53 +++++++--- ...xecuting_js_script_in_immediate_folder.yml | 24 +++-- .../prohibited_network_traffic_allowed.yml | 71 +++++++++----- 5 files changed, 201 insertions(+), 46 deletions(-) create mode 100644 data_sources/windows_event_log_security_4740.yml diff --git a/data_sources/windows_event_log_security_4740.yml b/data_sources/windows_event_log_security_4740.yml new file mode 100644 index 0000000000..f085e94675 --- /dev/null +++ b/data_sources/windows_event_log_security_4740.yml @@ -0,0 +1,97 @@ +name: Windows Event Log Security 4740 +id: 387936fa-efa9-425d-9f1b-487425250ea9 +version: 1 +creation_date: '2026-09-08' +modification_date: '2026-09-08' +author: Nasreddine Bencherchali, Splunk +description: Logs when a user account is locked out. It includes details about the account that was locked out, the subject, and additional information. +mitre_components: + - User Account Metadata +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '4740' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - Category + - change_type + - Channel + - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Guid + - host + - id + - Keywords + - Level + - linecount + - Logon_ID + - name + - Name + - object + - object_attrs + - object_category + - Opcode + - ProcessID + - product + - punct + - Record + - result + - session_id + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_Category + - tag + - tag::eventtype + - Target_User_Name + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_group + - user_name + - vendor + - vendor_product + - Version +output_fields: + - dest +example_log: 4740001382400x8020000000000000394306Securityar-win-dc.attackrange.localtestATTACKRANGE\testNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x3e7 diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index b2215aab9f..2b52bc3386 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -73,7 +73,7 @@ intermediate_findings: - field: src type: system score: 20 - message: The macOS host [$src$] used the Osascript utility with the command line [$process$] and a parent process [$parent_process_name$] to initiate a network connection to [$dest$] lasting [$duration$] minutes. + message: The macOS host [$src$] used the Osascript utility with the command line [$process$] and a parent process [$parent_process_name$] to initiate a network connection to [$dest$] lasting [$duration$]. threat_objects: - field: parent_process_name type: process_name diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index c78c5143c4..5cb6d13d5e 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -1,26 +1,53 @@ name: Detect Excessive User Account Lockouts id: 95a7f9a5-6096-437e-a19e-86f42ac609bd -version: 15 +version: 16 creation_date: '2020-04-29' -modification_date: '2026-05-13' -author: David Dorsey, Splunk +modification_date: '2026-09-08' +author: David Dorsey, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network. -data_source: [] +description: |- + The following analytic identifies user accounts experiencing more than 5 account lockouts within a 5-minute time window. + It leverages the 'Change' data model and groups account lockout events into 5-minute time buckets to identify a high frequency of lockouts associated with the same user and destination. + This activity may indicate password spraying, brute-force activity, or repeated authentication attempts using invalid or outdated credentials. + If confirmed malicious, this behavior may indicate an attempt to gain unauthorized access to user accounts and could precede further compromise or lateral movement within the environment. +data_source: + - Windows Event Log Security 4740 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes - WHERE All_Changes.result="*lock*" - BY All_Changes.user All_Changes.result + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + values(All_Changes.result) as "Result" + values(All_Changes.action) as "Action" + values(All_Changes.object_category) as "Object Category" + + FROM datamodel=Change.All_Changes WHERE + + All_Changes.action="lockout" + + BY _time span=5m + All_Changes.dest All_Changes.user + | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Account_Management")` + + | eval lockout_count = 5 + | where count > lockout_count + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | search count > 5 | `detect_excessive_user_account_lockouts_filter` -how_to_implement: ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. -known_false_positives: It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts. -references: [] +how_to_implement: |- + You must ingest your Windows Security Event Logs or similar data into the Change data model under the Account_Management node for this search to execute successfully. + The detection triggers when more than 5 account lockouts for the same user and destination occur within a 5-minute time bucket. + The lockout threshold and time window can be adjusted based on the authentication patterns and account-management practices in your environment. +known_false_positives: |- + Legitimate users may generate multiple account lockouts after repeatedly entering an incorrect password. + False positives may also occur when pre-configured accounts continue attempting authentication with outdated stored credentials after a password change. This can commonly occur with credentials configured for printers, network shares, services, scheduled tasks, applications, mapped drives, or other systems that automatically authenticate on behalf of a user. +references: + - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4740 + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold + - https://techcommunity.microsoft.com/blog/microsoft-security-baselines/configuring-account-lockout/701040/ drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' @@ -35,7 +62,7 @@ intermediate_findings: - field: user type: user score: 20 - message: Excessive user account lockouts for $user$ in a short period of time + message: User [$user$] experienced more than [$lockout_count$] account lockouts within a 5-minute time window. analytic_story: - Active Directory Password Spraying - Scattered Lapsus$ Hunters diff --git a/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml index 9c9c995c1e..12620b32bc 100644 --- a/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml +++ b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml @@ -28,16 +28,24 @@ search: |- ) Processes.process="*js" Processes.process_path IN ( - "*:\\Users\\*", "*:\\PerfLogs\\*", "*:\\ProgramData\\*", - "*:\\Temp\\*") - NOT Processes.process_path IN ( - "*\\AppData\\Local\\*", - "*\\AppData\\Roaming\\*", - "*\\node\\*", - "*\\nodejs\\*", - "*\\nvm\\*" + "*:\\Temp\\*", + "*:\\Users\\*" + ) + ( + NOT Processes.process_path IN ( + "*\\AppData\\Roaming\\*", + "*\\node\\*", + "*\\nodejs\\*", + "*\\nvm\\*" + ) + AND + ( + NOT Processes.process_path = "*\\AppData\\Local\\*" + OR + Processes.process_path = "*\\AppData\\Local\\Temp\\*" + ) ) by Processes.action Processes.dest Processes.original_file_name diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index 155b55babb..8f68a97364 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -1,30 +1,56 @@ name: Prohibited Network Traffic Allowed id: ce5a0962-849f-4720-a678-753fe6674479 -version: 14 +version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Rico Valdez, Splunk status: production -type: TTP -description: The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture. +type: Anomaly +description: |- + The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. + It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. + This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. + If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture. data_source: - Cisco Secure Firewall Threat Defense Connection Event search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic - WHERE All_Traffic.action IN ("allowed", "allow") [ - | inputlookup interesting_ports_lookup where is_prohibited="true" - | table dest_port transport - | dedup dest_port transport - | rename dest_port as All_Traffic.dest_port - | rename transport as All_Traffic.transport] by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product All_Traffic.rule + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + values(All_Traffic.src_port) as src_port + values(All_Traffic.action) as action + values(All_Traffic.rule) as rule + + FROM datamodel=Network_Traffic WHERE + + All_Traffic.action IN ("allowed", "allow") + [ + | inputlookup interesting_ports_lookup where is_prohibited="true" + | table dest_port transport + | dedup dest_port transport + | rename dest_port as All_Traffic.dest_port + | rename transport as All_Traffic.transport + ] + + by All_Traffic.src_ip All_Traffic.dest_ip + All_Traffic.dest_port All_Traffic.dvc + All_Traffic.vendor_product + | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `prohibited_network_traffic_allowed_filter` -how_to_implement: In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated. -known_false_positives: No false positives have been identified at this time. -references: [] +how_to_implement: |- + In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. + This is necessary so that the search can identify an 'action' taken on the traffic of interest. + The search also requires the Network_Traffic data model be populated. +known_false_positives: |- + The "interesting_ports_lookup" lookup considers communication to ports like 20, 21 for FTP, 23 for Telnet, 110 for POP3, etc. as prohibited traffic. Which may result in a lot of alerts in certain environments that still rely on these ports for legitimate traffic. Tune as needed. +references: + - https://securityscorecard.com/blog/ftp-security-risks/ + - https://secoraconsulting.com/blog/telnet-security-risks/ drilldown_searches: - name: View the detection results for - "$src_ip$" search: '%original_detection_search% | search src_ip = "$src_ip$"' @@ -34,12 +60,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Potentially Prohibited Network Traffic allowed from $src_ip$ - entity: - field: src_ip - type: system - score: 50 +intermediate_findings: + entities: + - field: src_ip + type: system + score: 20 + message: Potentially Prohibited Network Traffic on Port [$dest_port$] via Protocol [$transport$] allowed from [$src_ip$]. threat_objects: - field: dest_ip type: ip_address @@ -57,13 +83,10 @@ product: - Splunk Cloud category: network security_domain: network -baselines: - - Count of Unique IPs Connecting to Ports tests: - name: Cisco Secure Firewall True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log source: not_applicable sourcetype: cisco:sfw:estreamer - description: PORTED MANUAL TEST - This detection uses a builtin lookup from Enterprise Security. - test_type: experimental + test_type: unit From 424a788f19d776853778cdefee89e744df622caf Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 19:12:29 +0200 Subject: [PATCH 113/164] Fix Typo (#4278) --- detections/application/esxi_bulk_vm_termination.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/esxi_bulk_vm_termination.yml b/detections/application/esxi_bulk_vm_termination.yml index 4f8cd6c99d..2153c20e66 100644 --- a/detections/application/esxi_bulk_vm_termination.yml +++ b/detections/application/esxi_bulk_vm_termination.yml @@ -13,7 +13,7 @@ data_source: search: |- `esxi_syslog` Message IN ( - "*pkill -9 *" + "*pkill -9 *", "*process kill*" ) | rex field=_raw "\s\[(?[^\]]+)\]:\s(?.+)$" From 1a41f94ca5c6efede6a61cf83e75527ed84a8e1d Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 20:34:27 +0200 Subject: [PATCH 114/164] Maybe This is It? (#4279) --- .../macos___re_opened_applications.yml | 2 +- detections/deprecated/xmrig_driver_loaded.yml | 2 +- ...detect_excessive_user_account_lockouts.yml | 53 +++++-------------- .../prohibited_network_traffic_allowed.yml | 2 +- 4 files changed, 16 insertions(+), 43 deletions(-) diff --git a/detections/deprecated/macos___re_opened_applications.yml b/detections/deprecated/macos___re_opened_applications.yml index a2d8614cec..708d18b627 100644 --- a/detections/deprecated/macos___re_opened_applications.yml +++ b/detections/deprecated/macos___re_opened_applications.yml @@ -44,6 +44,6 @@ product: category: endpoint security_domain: threat deprecation_info: - reason: Detection deprecated as it is targeting a method of persistence that has been disabled in MacOS for years. As well, the fact that the detection has been set to experimental since 2020. + reason: Detection deprecated as it is targeting a method of persistence that has been disabled in MacOS for years. As well, as the fact that the detection has been set to experimental since 2020. removed_in_version: 6.10.0 replacement_content: [] diff --git a/detections/deprecated/xmrig_driver_loaded.yml b/detections/deprecated/xmrig_driver_loaded.yml index efd2ac89a2..325f1d027d 100644 --- a/detections/deprecated/xmrig_driver_loaded.yml +++ b/detections/deprecated/xmrig_driver_loaded.yml @@ -50,7 +50,7 @@ tests: sourcetype: XmlWinEventLog test_type: unit deprecation_info: - reason: Detection deprecated as it is inacurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0. + reason: Detection deprecated as it is inaccurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0. removed_in_version: 6.10.0 replacement_content: - Windows Vulnerable Driver Installed diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index 5cb6d13d5e..c78c5143c4 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -1,53 +1,26 @@ name: Detect Excessive User Account Lockouts id: 95a7f9a5-6096-437e-a19e-86f42ac609bd -version: 16 +version: 15 creation_date: '2020-04-29' -modification_date: '2026-09-08' -author: David Dorsey, Nasreddine Bencherchali, Splunk +modification_date: '2026-05-13' +author: David Dorsey, Splunk status: production type: Anomaly -description: |- - The following analytic identifies user accounts experiencing more than 5 account lockouts within a 5-minute time window. - It leverages the 'Change' data model and groups account lockout events into 5-minute time buckets to identify a high frequency of lockouts associated with the same user and destination. - This activity may indicate password spraying, brute-force activity, or repeated authentication attempts using invalid or outdated credentials. - If confirmed malicious, this behavior may indicate an attempt to gain unauthorized access to user accounts and could precede further compromise or lateral movement within the environment. -data_source: - - Windows Event Log Security 4740 +description: The following analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network. +data_source: [] search: |- - | tstats `security_content_summariesonly` - count min(_time) as firstTime - max(_time) as lastTime - values(All_Changes.result) as "Result" - values(All_Changes.action) as "Action" - values(All_Changes.object_category) as "Object Category" - - FROM datamodel=Change.All_Changes WHERE - - All_Changes.action="lockout" - - BY _time span=5m - All_Changes.dest All_Changes.user - + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes + WHERE All_Changes.result="*lock*" + BY All_Changes.user All_Changes.result | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Account_Management")` - - | eval lockout_count = 5 - | where count > lockout_count - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | search count > 5 | `detect_excessive_user_account_lockouts_filter` -how_to_implement: |- - You must ingest your Windows Security Event Logs or similar data into the Change data model under the Account_Management node for this search to execute successfully. - The detection triggers when more than 5 account lockouts for the same user and destination occur within a 5-minute time bucket. - The lockout threshold and time window can be adjusted based on the authentication patterns and account-management practices in your environment. -known_false_positives: |- - Legitimate users may generate multiple account lockouts after repeatedly entering an incorrect password. - False positives may also occur when pre-configured accounts continue attempting authentication with outdated stored credentials after a password change. This can commonly occur with credentials configured for printers, network shares, services, scheduled tasks, applications, mapped drives, or other systems that automatically authenticate on behalf of a user. -references: - - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4740 - - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold - - https://techcommunity.microsoft.com/blog/microsoft-security-baselines/configuring-account-lockout/701040/ +how_to_implement: ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. +known_false_positives: It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts. +references: [] drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' @@ -62,7 +35,7 @@ intermediate_findings: - field: user type: user score: 20 - message: User [$user$] experienced more than [$lockout_count$] account lockouts within a 5-minute time window. + message: Excessive user account lockouts for $user$ in a short period of time analytic_story: - Active Directory Password Spraying - Scattered Lapsus$ Hunters diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index 8f68a97364..2235c3e236 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -34,7 +34,7 @@ search: |- by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc - All_Traffic.vendor_product + All_Traffic.transport All_Traffic.vendor_product | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note From aea632a1484372e12cbbfd34c2a80d316bdbdd13 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 23 Sep 2026 10:56:16 -0700 Subject: [PATCH 115/164] Update Goolge Cloud TA (#4284) --- install.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install.yml b/install.yml index f487b52fed..f031247a96 100644 --- a/install.yml +++ b/install.yml @@ -24,7 +24,7 @@ apps: version: 1.3.2 - appid: Splunk_TA_google-cloudplatform url: https://splunkbase.splunk.com/app/3088 - version: 5.1.1 + version: 5.2.0 - appid: utbox url: https://splunkbase.splunk.com/app/2734 version: 1.9.4 From 9640c033be1f2c2811cac0401e5f163ff4db011f Mon Sep 17 00:00:00 2001 From: Tessa Georgen <67936042+tjgeorgen@users.noreply.github.com> Date: Wed, 23 Sep 2026 14:00:31 -0400 Subject: [PATCH 116/164] expected_results should be 1 on lolbas detection (#4280) Co-authored-by: Nasreddine Bencherchali --- .../endpoint/lolbas_network_connection_on_uncommon_port.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml index bba241d4c1..aa4777b88a 100644 --- a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml +++ b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml @@ -162,5 +162,5 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - expected_results: 0 + expected_results: 1 test_type: unit From 64acde7bf6df712c95e759fbcb76a841b5c8128d Mon Sep 17 00:00:00 2001 From: sbaker-gre Date: Thu, 24 Sep 2026 11:58:25 -0500 Subject: [PATCH 117/164] Azure AD consent detections: repair Scope regex broken by a line wrap (#4291) Co-authored-by: Nasreddine Bencherchali --- ...th_application_consent_granted_by_user.yml | 37 +++++++++++++++--- ..._consent_blocked_for_risky_application.yml | 39 ++++++++++++++++--- 2 files changed, 64 insertions(+), 12 deletions(-) diff --git a/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml b/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml index 80d1f91370..7ac29c4a6b 100644 --- a/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml +++ b/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml @@ -1,17 +1,42 @@ name: Azure AD OAuth Application Consent Granted By User id: 10ec9031-015b-4617-b453-c0c1ab729007 -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents. This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access. If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks. +description: |- + The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents. + This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access. + If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks. data_source: - Azure Active Directory Consent to application -search: "`azure_monitor_aad` operationName=\"Consent to application\" properties.result=success | rename properties.* as * | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\"), -1) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) | rex field=permissions \"Scope: (? [ ^,]+)\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product Scope signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_oauth_application_consent_granted_by_user_filter`" -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. -known_false_positives: False positives may occur if users are granting consents as part of legitimate application integrations or setups. It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices. +search: |- + `azure_monitor_aad` + operationName="Consent to application" + properties.result=success + + | rename properties.* as * + + | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1) + | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) + | rex field=permissions "Scope: (?[^,]+)" + + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user src vendor_account vendor_product Scope signature + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `azure_ad_oauth_application_consent_granted_by_user_filter` +how_to_implement: |- + You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. +known_false_positives: |- + False positives may occur if users are granting consents as part of legitimate application integrations or setups. + It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices. references: - https://attack.mitre.org/techniques/T1528/ - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/ diff --git a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml index 33466bc223..9fc6cc7550 100644 --- a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml @@ -1,17 +1,44 @@ name: Azure AD User Consent Blocked for Risky Application id: 06b8ec9a-d3b5-4882-8f16-04b4d10f5eab -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks. Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures. +description: |- + The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. + This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks. + Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. + If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures. data_source: - Azure Active Directory Consent to application -search: "`azure_monitor_aad` operationName=\"Consent to application\" properties.result=failure | rename properties.* as * | eval reason_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Reason\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Reason\"), -1) | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\"), -1) | search reason_index >= 0 | eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) | search reason = \"\\\"Risky application detected\\\"\" | rex field=permissions \"Scope: (? [ ^,]+)\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product reason Scope signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_user_consent_blocked_for_risky_application_filter`" -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +search: |- + `azure_monitor_aad` + operationName="Consent to application" + properties.result=failure + + | rename properties.* as * + + | eval reason_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Reason") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Reason"), -1) + | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1) + | search reason_index >= 0 + | eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) + | search reason = "Risky application detected" + | rex field=permissions "Scope: (?[^,]+)" + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user src vendor_account vendor_product reason Scope signature + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `azure_ad_user_consent_blocked_for_risky_application_filter` +how_to_implement: |- + You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1528/ - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/ From 21bcc53536a0e41f079e9cff70ab69eeaacf3c5b Mon Sep 17 00:00:00 2001 From: sbaker-gre Date: Tue, 29 Sep 2026 04:08:21 -0500 Subject: [PATCH 118/164] Windows Crowdstrike RTR Script Execution: match EDR sources without a parent command line (#4294) --------- Co-authored-by: Nasreddine Bencherchali --- .../endpoint/windows_crowdstrike_rtr_script_execution.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml b/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml index 801437cc58..eeaa18f134 100644 --- a/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml +++ b/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml @@ -1,8 +1,8 @@ name: Windows Crowdstrike RTR Script Execution id: be2bbfff-77c9-4d65-9b7c-97726051534a -version: 2 +version: 3 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-09-28' author: Raven Tait, Splunk status: production type: Anomaly @@ -20,7 +20,7 @@ search: |- from datamodel=Endpoint.Processes where Processes.parent_process_name="dllhost.exe" - Processes.parent_process="*/Processid:{BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2}*" + Processes.parent_process IN ("*/Processid:{BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2}*", "unknown") Processes.process_name="powershell.exe" Processes.process="* -Version 5.1 -s -NoLogo -NoProfile -EncodedCommand*" From 9aff0d8628193ee2a82c355d049dbf8f462deab0 Mon Sep 17 00:00:00 2001 From: sbaker-gre Date: Tue, 29 Sep 2026 05:08:06 -0500 Subject: [PATCH 119/164] O365 message trace detections: support o365:graph:messagetrace (Office 365 add-on 6.x) (#4286) Splunk Add-on for Microsoft Office 365 6.x collects message trace through Microsoft Graph and emits sourcetype o365:graph:messagetrace with camelCase fields (senderAddress, recipientAddress, messageId, status) instead of the PascalCase fields of the retired Reporting web service sourcetypes. - Add o365:graph:messagetrace to the o365_messagetrace macro. - Switch the four dependent detections from raw field names to the CIM fields the add-on aliases for both sourcetypes: status_code, recipient, src_user, message_id. Behaviour is unchanged on the legacy sourcetypes. - Replace the Organization field, which the Graph sourcetype does not carry, with a sender-domain vs recipient-domain comparison. - Update drilldowns to use recipient. Affected: O365 Email Password and Payroll Compromise Behavior, O365 Email Receive and Hard Delete Takeover Behavior, O365 Email Send and Hard Delete Exfiltration Behavior, O365 Email Send Attachments Excessive Volume. --------- Co-authored-by: Nasreddine Bencherchali --- ...ssword_and_payroll_compromise_behavior.yml | 29 +++++++++++----- ...eive_and_hard_delete_takeover_behavior.yml | 29 +++++++++++----- ..._and_hard_delete_exfiltration_behavior.yml | 34 +++++++++++++------ ...mail_send_attachments_excessive_volume.yml | 33 +++++++++++++----- macros/o365_messagetrace.yml | 6 ++-- 5 files changed, 93 insertions(+), 38 deletions(-) diff --git a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml index e48b35f375..9b4d1e6d12 100644 --- a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml +++ b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml @@ -1,12 +1,14 @@ name: O365 Email Password and Payroll Compromise Behavior id: e36de71a-6bdc-4002-98ff-e3e51b0d8f96 -version: 7 +version: 8 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: TTP -description: The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. +description: |- + The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. + This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -14,8 +16,8 @@ search: |- `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") | eval mailtime = _time | bin _time span=4hr - | eval user = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("SoftDelete","HardDelete") @@ -32,8 +34,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_password_and_payroll_compromise_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -48,7 +52,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" - name: Investigate Email for $user$ - search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") RecipientAddress = "$user$"' + search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") recipient = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ finding: @@ -86,3 +90,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml index 5362379aa3..51c0ec9f30 100644 --- a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml +++ b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml @@ -1,12 +1,14 @@ name: O365 Email Receive and Hard Delete Takeover Behavior id: b66aeaa4-586f-428b-8a2b-c4fd3039d8d3 -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. +description: |- + The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. + This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -14,8 +16,8 @@ search: |- `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") | eval mailtime = _time | bin _time span=4hr - | eval user = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions") @@ -31,8 +33,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_receive_and_hard_delete_takeover_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Possible new user/account onboarding processes. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Possible new user/account onboarding processes. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -47,7 +51,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" - name: Investigate Email for $user$ - search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND RecipientAddress = "$user$"' + search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND recipient = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ intermediate_findings: @@ -87,3 +91,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml index 5fc9037fee..174bf25eb1 100644 --- a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml +++ b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml @@ -1,21 +1,24 @@ name: O365 Email Send and Hard Delete Exfiltration Behavior id: dd7798cf-c4f5-4114-ad0f-beacd9a33708 -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner. +description: |- + The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). + This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. + This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace search: |- - `o365_messagetrace` Status=Delivered + `o365_messagetrace` status_code=Delivered | eval mailtime = _time | bin _time span=1hr - | eval user = lower(SenderAddress), recipient = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(src_user), recipient = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user, max=0 [ | search `o365_management_activity` Workload=Exchange (Operation IN ("Send*")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")) @@ -26,14 +29,16 @@ search: |- | stats values(sender) as sender, values(ClientInfoString) as http_user_agent, values(InternetMessageId) as InternetMessageId, values(file_name) as file_name, sum(file_size) as file_size, values(sendtime) as firstTime, values(deltime) as lastTime values(Operation) as signature, dc(Operation) as opcount, count by _time,subject,user | where opcount > 1 AND firstTime < lastTime ] - | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime count by subject,user,recipient,Organization - | eval externalRecipient = if(match(lower(recipient),mvindex(split(lower(Organization),"."),0)),0,1) + | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime count by subject,user,recipient + | eval externalRecipient = if(mvindex(split(lower(recipient),"@"),1)==mvindex(split(lower(user),"@"),1),0,1) | where externalRecipient = 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_and_hard_delete_exfiltration_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Users that habitually/proactively cleaning the recoverable items folder may trigger this alert. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -90,3 +95,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_send_attachments_excessive_volume.yml b/detections/cloud/o365_email_send_attachments_excessive_volume.yml index 3842d035ee..1616e1a270 100644 --- a/detections/cloud/o365_email_send_attachments_excessive_volume.yml +++ b/detections/cloud/o365_email_send_attachments_excessive_volume.yml @@ -1,20 +1,24 @@ name: O365 Email Send Attachments Excessive Volume id: 70a050a2-8537-488a-a628-b60a9558d96a -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors. +description: |- + The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). + This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. + Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. + Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors. data_source: - Office 365 Universal Audit Log search: |- - `o365_messagetrace` Status=Delivered + `o365_messagetrace` status_code=Delivered | eval mailtime = _time | bin _time span=1hr - | eval user = lower(SenderAddress), recipient = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(src_user), recipient = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user, _time max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("Send","SendAs","SendOnBehalf") @@ -27,14 +31,16 @@ search: |- | eval file_name = mvjoin(file_name,"||") ] | eval file_name = split(file_name,"||") - | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,Organization,InternetMessageId + | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,InternetMessageId | eval recipient = mvmap(recipient, if(match(mvindex(split(lower(recipient),"@"),1),mvindex(split(lower(user),"@"),1)), null(),recipient)) | search recipient = * | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_attachments_excessive_volume_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -84,3 +90,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/macros/o365_messagetrace.yml b/macros/o365_messagetrace.yml index 390f011741..2b530a58f2 100644 --- a/macros/o365_messagetrace.yml +++ b/macros/o365_messagetrace.yml @@ -1,8 +1,8 @@ name: o365_messagetrace id: 1ead5eb3-85e8-40fb-9eb4-6936843f08d6 -version: 1 +version: 2 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Splunk Threat Research Team description: Customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace") +definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace","o365:graph:messagetrace") From cc1890337230930fd32c40fff5125acb0ec5ecb8 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 29 Sep 2026 15:21:46 -0700 Subject: [PATCH 120/164] improve format for attack data links so (#4299) they are in line with all other attack data links --- ...o_nvm___osascript_network_connection_for_a_long_duration.yml | 2 +- .../endpoint/macos_osascript_executing_interactive_shell.yml | 2 +- .../macos_osascript_executing_javascript_code_with_objc.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index 2b52bc3386..b30c5e3f41 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -98,7 +98,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log source: not_applicable sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/macos_osascript_executing_interactive_shell.yml b/detections/endpoint/macos_osascript_executing_interactive_shell.yml index c308ce8fc1..5c50548ce5 100644 --- a/detections/endpoint/macos_osascript_executing_interactive_shell.yml +++ b/detections/endpoint/macos_osascript_executing_interactive_shell.yml @@ -80,7 +80,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log source: osquery sourcetype: osquery:results test_type: unit diff --git a/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml index 370282b170..b0a26a4897 100644 --- a/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml +++ b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml @@ -80,7 +80,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log source: osquery sourcetype: osquery:results test_type: unit From 4a7da063357487c9a75f659640570c63e74e9e3e Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Wed, 30 Sep 2026 16:48:50 +0200 Subject: [PATCH 121/164] New Detection Coverage for ShieldCrash Exploit --- ...e_data_stream_created_over_local_share.yml | 6 +- ...der_intermediary_artifact_was_observed.yml | 77 +++++++++++++++++++ 2 files changed, 80 insertions(+), 3 deletions(-) create mode 100644 detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml diff --git a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml index bd2877700b..aea125442a 100644 --- a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml +++ b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml @@ -1,8 +1,8 @@ name: Windows Alternate Data Stream Created Over Local Share id: e974a5c9-cbe9-4b4a-8fba-b55e7dbc8259 -version: 1 +version: 2 creation_date: '2026-08-19' -modification_date: '2026-08-19' +modification_date: '2026-09-30' author: Onur Mustafa Erdogan, Splunk status: production type: Anomaly @@ -17,7 +17,7 @@ data_source: search: |- `wineventlog_security` EventCode=5145 - IpAddress="127.0.0.1" + IpAddress IN ("127.0.0.1", "::1") ObjectType="File" | regex RelativeTargetName="(?i)\:\w+$" | fillnull diff --git a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml new file mode 100644 index 0000000000..64c7d7d195 --- /dev/null +++ b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml @@ -0,0 +1,77 @@ +name: Windows Defender Intermediary Artifact Was Observed +id: 5234fb35-da15-4e45-8e17-3b7ae0e0fc9e +version: 1 +creation_date: '2026-09-30' +modification_date: '2026-09-30' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects creation and removal of intermediary remediation artifacts of Windows Defender, during exploitation of ShieldCrash attacks. + Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the + symbolic link to redirect the remediation process to a staging directory controlled by the attacker. This detection aims to detect creation of defender artifact, + its alternate data stream, and their subsequent removal. +data_source: + - Sysmon EventID 11 AND Sysmon EventID 15 AND Sysmon EventID 23 +search: |- + `sysmon` + EventID IN (11, 15, 23) + process_name IN ("system","msmpeng.exe") + user=SYSTEM + AND NOT TargetFilename IN ("C:\\Windows\\Temp\\*", "*:Zone.Identifier", "*:SmartScreen") + | stats values(EventID) as EventID dc(EventID) as dc_EventID values(TargetFilename) as TargetFilename + dc(TargetFilename) as dc_TargetFilename min(_time) as firstTime max(_time) as lastTime count + by dest process_id process_name user file_name file_path + | regex file_path!="(?i)\.\w{1,10}$" + | search dc_TargetFilename>1 dc_EventID>1 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_intermediary_artifact_was_observed_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting file creation, file stream creation and file deletion events from your endpoints using Sysmon. + These logs must be processed using the latest Sysmon Technical Add-on (https://splunkbase.splunk.com/app/5709). Make sure to update Sysmon configuration to include + directories you would like to monitor for these kinds of events. +known_false_positives: |- + Remediation of various container files, such as archives, might also lead to creation various defender artifacts + SmartScreen interferes with the remediation process, potentially causing additional defender artifacts to be created. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.cyderes.com/howler-cell/shieldcrash-microsoft-zero-day?hs_amp=true + - https://socradar.io/blog/shieldcrash-poc-microsoft-defender-fix-bypass/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Intermediary artifacts [$TargetFilename$] were observed by [$process_name$] during Defender Remediation process on [$dest$] +threat_objects: + - field: TargetFilename + type: file_path +analytic_story: + - RoguePlanet + - Windows Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From 964fd332411bb16e2f62408796ef7ea0716cfe28 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Thu, 1 Oct 2026 05:55:22 -0400 Subject: [PATCH 122/164] Add New Rule Covering ResetNightmare (#4289) --------- Co-authored-by: Nasreddine Bencherchali --- .../windows_ad_user_suspicious_upn_change.yml | 91 +++++++++++++++++++ ...ws_admin_password_changed_by_non_admin.yml | 32 +++++-- 2 files changed, 115 insertions(+), 8 deletions(-) create mode 100644 detections/endpoint/windows_ad_user_suspicious_upn_change.yml diff --git a/detections/endpoint/windows_ad_user_suspicious_upn_change.yml b/detections/endpoint/windows_ad_user_suspicious_upn_change.yml new file mode 100644 index 0000000000..aa955d2dd7 --- /dev/null +++ b/detections/endpoint/windows_ad_user_suspicious_upn_change.yml @@ -0,0 +1,91 @@ +name: Windows AD User Suspicious UPN Change +id: 81324b8b-46c0-4ca3-b9a1-d33638f21021 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738. + This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account. + The KDC then resolves a ptype=10 (NT-ENTERPRISE) Kerberos pre-authentication request against the spoofed UPN, issuing a kadmin/changepw TGT that can be used to change the target account's password via kpasswd (port 464). + Event 4738 is generated when a user account attribute is changed. This analytic filters to events where the SubjectUserSid equals the TargetSid (self-modification), the new UPN value is not a standard UPN (no @ sign), and the value is not a Windows placeholder. + A non-UPN value set on one's own account is anomalous and has no legitimate administrative use case. +data_source: + - Windows Event Log Security 4738 +search: |- + `wineventlog_security` + EventCode=4738 + UserPrincipalName="*" + NOT UserPrincipalName IN ( + "-", + "", + "*@*", + "%%1793" + ) + NOT SubjectUserSid IN ( + "S-1-5-18", + "S-1-5-7" + ) + NOT SubjectUserName IN ( + "ANONYMOUS*", + "NT AUTHORITY*" + ) + + | where SubjectUserSid=TargetSid + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by dest SubjectUserName SubjectUserSid TargetUserName TargetSid UserPrincipalName + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_user_suspicious_upn_change_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled. +known_false_positives: |- + Administrators or identity management tools may legitimately set a UPN that does not contain an @ sign during account provisioning or migration workflows. Investigate the SubjectUserName and context to confirm. +references: + - https://cravaterouge.com/articles/resetnightmare/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: User [$SubjectUserName$] set their UPN to [$UserPrincipalName$] on $dest$ + entity: + field: SubjectUserName + type: user + score: 50 +threat_objects: + - field: SubjectUserName + type: user +analytic_story: + - Active Directory Kerberos Attacks +asset_type: Endpoint +cve: + - CVE-2026-27912 +mitre_attack_id: + - T1078.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml index 7bb99a45b9..3c8a2b17db 100644 --- a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml +++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml @@ -1,8 +1,8 @@ name: Windows Admin Password Changed by Non-Admin id: 6d4c4d88-cd60-43a1-8c70-c74a9614f724 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-09-23' author: Raven Tait, Splunk status: production type: TTP @@ -13,15 +13,27 @@ data_source: search: |- `wineventlog_security` EventCode=4723 - | rex field=object_id "-(?\d+)$" + TargetSid IN ( + "*500*", + "*512*", + "*513*", + "*518*", + "*519*", + "*520*" + ) + + | rex field=TargetSid "-(?\d+)$" | rex field=SubjectUserSid "-(?\d+)$" - | where target_rid="500" OR tonumber(target_rid) IN (512,513,518,519,520) + + | where tonumber(target_rid)=500 OR tonumber(target_rid) IN (512,513,518,519,520) | where tonumber(subject_rid) >= 1000 - | where SubjectUserSid != object_id + | where subject_rid != target_rid + | stats count min(_time) as firstTime max(_time) as lastTime - by dest user object_id EventCode src_user - SubjectUserSid SubjectLogonId PrivilegeList + + by dest TargetSid EventCode SubjectUserSid src_user TargetUserName + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admin_password_changed_by_non_admin_filter` @@ -41,17 +53,21 @@ drilldown_searches: name: View risk events for the last 7 days for - "$dest$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' finding: - title: Non-Administrator account $src_user$ changed password of Admin account $user$ on $dest$. + title: Non-Administrator account [$src_user$] changed the password of the Admin account [$user$] on $dest$. entity: field: dest type: system score: 50 +threat_objects: + - field: src_user + type: user analytic_story: - Windows Privilege Escalation - BlueHammer asset_type: Endpoint cve: - CVE-2026-33825 + - CVE-2026-27912 mitre_attack_id: - T1068 - T1543.003 From 466d5b3d88615763a22d48fac1505934e361ad43 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Thu, 1 Oct 2026 16:14:20 +0200 Subject: [PATCH 123/164] Update windows_defender_intermediary_artifact_was_observed.yml --- ...der_intermediary_artifact_was_observed.yml | 28 +++++++++++++++---- 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml index 64c7d7d195..a5a3a0d4e9 100644 --- a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml +++ b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml @@ -16,14 +16,30 @@ data_source: search: |- `sysmon` EventID IN (11, 15, 23) - process_name IN ("system","msmpeng.exe") + process_name IN ( + "System", + "msmpeng.exe" + ) user=SYSTEM - AND NOT TargetFilename IN ("C:\\Windows\\Temp\\*", "*:Zone.Identifier", "*:SmartScreen") - | stats values(EventID) as EventID dc(EventID) as dc_EventID values(TargetFilename) as TargetFilename - dc(TargetFilename) as dc_TargetFilename min(_time) as firstTime max(_time) as lastTime count - by dest process_id process_name user file_name file_path - | regex file_path!="(?i)\.\w{1,10}$" + NOT TargetFilename IN ( + "C:\\Windows\\Temp\\*", + "*:Zone.Identifier", + "*:SmartScreen" + ) + + | regex TargetFilename!="(?i)\.\w{1,10}$" + + | stats count values(EventID) as EventID + values(TargetFilename) as TargetFilename + dc(EventID) as dc_EventID + dc(TargetFilename) as dc_TargetFilename + min(_time) as firstTime + max(_time) as lastTime + + by dest process_id process_name user + | search dc_TargetFilename>1 dc_EventID>1 + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_defender_intermediary_artifact_was_observed_filter` From 896f8d9e2fc034e0441e3c10093ad599a0e113e4 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 1 Oct 2026 07:17:01 -0700 Subject: [PATCH 124/164] Update data source TA and install.yml app versions (#4302) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/m365_copilot_graph_api.yml | 2 +- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/o365.yml | 2 +- data_sources/o365_add_app_role_assignment_grant_to_user_.yml | 2 +- .../o365_add_app_role_assignment_to_service_principal_.yml | 2 +- data_sources/o365_add_mailboxpermission.yml | 2 +- data_sources/o365_add_member_to_role_.yml | 2 +- data_sources/o365_add_owner_to_application_.yml | 2 +- data_sources/o365_add_service_principal_.yml | 2 +- data_sources/o365_change_user_license_.yml | 2 +- data_sources/o365_consent_to_application_.yml | 2 +- data_sources/o365_disable_strong_authentication_.yml | 2 +- data_sources/o365_mailitemsaccessed.yml | 2 +- data_sources/o365_modifyfolderpermissions.yml | 2 +- data_sources/o365_set_company_information_.yml | 2 +- data_sources/o365_set_mailbox.yml | 2 +- data_sources/o365_update_application_.yml | 2 +- data_sources/o365_update_authorization_policy_.yml | 2 +- data_sources/o365_update_user_.yml | 2 +- data_sources/o365_userloggedin.yml | 2 +- data_sources/o365_userloginfailed.yml | 2 +- data_sources/office_365_reporting_message_trace.yml | 2 +- data_sources/office_365_universal_audit_log.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1116.yml | 2 +- data_sources/windows_event_log_defender_1117.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4740.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_security_5441.yml | 2 +- data_sources/windows_event_log_security_5447.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 125 files changed, 125 insertions(+), 125 deletions(-) diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index eef7d37443..ab7410db47 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -10,7 +10,7 @@ sourcetype: o365:graph:api supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - appDisplayName - appId diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 749a2d3ae1..4f9bbaca4e 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index 045f5a43f3..b179ee9d96 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index d7df32bf79..ecf8af19a2 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/o365.yml b/data_sources/o365.yml index 4184acc03e..ca824bcbf3 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -17,4 +17,4 @@ separator: Operation supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 1687c98ff8..00bc4805b4 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment grant to user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 925288235d..67062042d5 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 79d4333bbb..9c2dd48871 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -17,7 +17,7 @@ separator_value: Add-MailboxPermission supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AccessRights diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index a69da205d9..bc771f7805 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -17,7 +17,7 @@ separator_value: Add member to role. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index aa2db39030..a37f369403 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 3b4615afa7..37c92818d4 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index d6451bc035..648a5cfcfc 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -17,7 +17,7 @@ separator_value: Change user license. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index f12ada70fd..5e89011933 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Consent to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index 3e75abb378..b18af0076e 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -17,7 +17,7 @@ separator_value: Disable Strong Authentication. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index 3860a0da92..ba8649b87b 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -17,7 +17,7 @@ separator_value: MailItemsAccessed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index bf30472105..40683dcd19 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -17,7 +17,7 @@ separator_value: ModifyFolderPermissions supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index e40e2d4917..f73672008b 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -17,7 +17,7 @@ separator_value: Set Company Information. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_set_mailbox.yml b/data_sources/o365_set_mailbox.yml index 07dff02233..cbc4206d88 100644 --- a/data_sources/o365_set_mailbox.yml +++ b/data_sources/o365_set_mailbox.yml @@ -17,7 +17,7 @@ separator_value: Set-Mailbox supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 48912324ff..6efbb68a3b 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -17,7 +17,7 @@ separator_value: Update application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index 0feeb95bdf..e835ce51ad 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -17,7 +17,7 @@ separator_value: Update authorization policy. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 0b264ec1b2..925465e2f7 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -17,7 +17,7 @@ separator_value: Update user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 0402ece5bf..00c0f8fa06 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -17,7 +17,7 @@ separator_value: UserLoggedIn supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index 61907c7546..bdacceddf4 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -17,7 +17,7 @@ separator_value: UserLoginFailed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/office_365_reporting_message_trace.yml b/data_sources/office_365_reporting_message_trace.yml index 1c2f9ffefc..8cd1af8c3c 100644 --- a/data_sources/office_365_reporting_message_trace.yml +++ b/data_sources/office_365_reporting_message_trace.yml @@ -11,7 +11,7 @@ separator: Organization supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - FromIP - Index diff --git a/data_sources/office_365_universal_audit_log.yml b/data_sources/office_365_universal_audit_log.yml index c9273ae119..1b72cc576d 100644 --- a/data_sources/office_365_universal_audit_log.yml +++ b/data_sources/office_365_universal_audit_log.yml @@ -11,7 +11,7 @@ separator: Operation supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time example_log: '' diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6089a236b5..f5c6668fa1 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index b43f02de4b..77746de129 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 953e724a1e..5198777c72 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index dfbc3ae1ed..6f026135e3 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index df3d27c6c7..b5c5f36115 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 7f333a78f9..6e376dc028 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index e3841b7d77..0135033e88 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 6c924b1ebb..d198bf8189 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index f72140ae8d..c6f21e79e3 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 870de7ee17..5cca95235e 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index cf70c22f8c..8b42fea335 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 592e0b6ef3..aac5be676c 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index 66ada13148..d0df9f5dce 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 4c7a4f8b93..f0fc859884 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml index 9b02654eb1..8be3dfc440 100644 --- a/data_sources/windows_event_log_defender_1116.yml +++ b/data_sources/windows_event_log_defender_1116.yml @@ -16,7 +16,7 @@ separator_value: '1116' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action_ID diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml index 4eee9d4d80..b7ffdd9830 100644 --- a/data_sources/windows_event_log_defender_1117.yml +++ b/data_sources/windows_event_log_defender_1117.yml @@ -16,7 +16,7 @@ separator_value: '1117' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action_Name diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index e79d991237..9c345f89e1 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index ad28a09086..2944fc6126 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index db460b697e..18308e1477 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 2bbe2b2b19..43fc814187 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index ad851b6a94..4ba86029d7 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index c014f6885a..e38fadd8e0 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 88a8748b5b..ef1a010606 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 70dc254190..90d22162d6 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index f5889d38fd..59d8d06984 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 10c8ddbede..034cb376ca 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 2aa8588d75..65a5a4a155 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 28d99290fb..0088b7e89f 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index 38622b24f5..bb4019035a 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 060336e042..79ab58fc3e 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 75f9683746..5d3ccb17ab 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index f59cb881fd..21041873b4 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index c48507cfc3..d5dbfd0c90 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index dad4989547..6de42e817e 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index 89fba03f2c..83f0397f05 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index b4667be60c..1ac6a07c6e 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index fa95daaa50..a6aad97997 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 104eb80b58..52f47aacca 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 289d62a902..f80791c7df 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 989857e278..80f51515f9 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index a440f483f9..65e778bf22 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 54054afabb..0017cf0583 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 3d13a756ee..3403e64193 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - EventID example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 4c180ca38a..bddee9b6ce 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - EventID example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index ed09ed27bd..310316fd12 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 4a8dfb8ca5..bf7bc7d2aa 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 5e2bbda6ab..1372f74573 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index fd486f8f61..5f96b26f47 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index a9cd94593d..81c019c3b4 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 9524a3f72f..ab583b54cf 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 8136745ad8..93d2716a2e 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 24032e276b..05b8d2bd41 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index ab74f07c8d..482d06ddf7 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index d73d16002d..f6cf01a48d 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index fefeeec125..7d1b7a78cd 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 3fdffb89a8..803b5e8cb4 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 881d7ccf05..6241a8694e 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 9c4df3de2d..4e15e78539 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index 7784f95bb3..60ac157f3d 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4740.yml b/data_sources/windows_event_log_security_4740.yml index f085e94675..b070516752 100644 --- a/data_sources/windows_event_log_security_4740.yml +++ b/data_sources/windows_event_log_security_4740.yml @@ -14,7 +14,7 @@ separator_value: '4740' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - action diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 1c4c800fe0..113dfdb62a 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 027458aca6..73a3e378cc 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index f02e15fa1a..17716ec455 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index dac0a891f9..cab2404af9 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 27c818f289..81bd73fe37 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index f73f48479e..a507ddf54d 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 8978d1ea3f..44d305da80 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 44102ebf15..72a021b5ab 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index f29190cc07..85f20a4617 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index bff553454a..3a247d6869 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index b01e5a06bb..af76586dde 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index f8856f02cd..32ee3e86b6 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index c21f93675c..ed112d8efe 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index da4093a413..4636083cdf 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 75ffcb4b33..dbe5284202 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 50d72b8dc7..f9c23c5c7c 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 8c021ffff6..4a93ee7e35 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index fc950fe649..29fd942c97 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 88e0dff853..d76820b4e0 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 361668dc89..f247ab52d0 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 892346a598..6bf8d9f631 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 3ed3918118..34f0f502fc 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index fe9b0aa1ac..987a9f9501 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 4ff1c91b19..f52138e52a 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 31c604a503..f5aa6f25df 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 03d0bbe1f6..a5104efd60 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index bd20531413..aa637f928a 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5441.yml b/data_sources/windows_event_log_security_5441.yml index e8a62868bd..0406dee9ca 100644 --- a/data_sources/windows_event_log_security_5441.yml +++ b/data_sources/windows_event_log_security_5441.yml @@ -17,7 +17,7 @@ configuration: Enable the Audit Filtering Platform Policy Change subcategory to supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml index 94e8f2a90c..d1f16649a7 100644 --- a/data_sources/windows_event_log_security_5447.yml +++ b/data_sources/windows_event_log_security_5447.yml @@ -17,7 +17,7 @@ configuration: Enable the Audit Filtering Platform Policy Change subcategory to supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index b7298c6713..2441f3fffb 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 5b95d4b808..f386952c7d 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index b5590d7546..50059d6e56 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 2ca373f47e..7a36f05d1d 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 6cd9b92a19..ef0de6543d 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index d43588fae6..3e0518531c 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 1aa7fef426..eac759b2d8 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index 31739b254e..81161d7f0d 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 6809dbf363..e429edceb1 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 521b00579b..a2adad94a8 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 27abf33af6..d846b31746 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName From c69f2137fae821fae7d712f14bdcddffd7b37e35 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 1 Oct 2026 17:31:50 +0200 Subject: [PATCH 125/164] add script and workflow for archived TAs (#4301) --- .github/workflows/archived-ta-tracker.yml | 32 +++ scripts/check_archived_tas.py | 245 ++++++++++++++++++++++ 2 files changed, 277 insertions(+) create mode 100644 .github/workflows/archived-ta-tracker.yml create mode 100644 scripts/check_archived_tas.py diff --git a/.github/workflows/archived-ta-tracker.yml b/.github/workflows/archived-ta-tracker.yml new file mode 100644 index 0000000000..25d202bf6a --- /dev/null +++ b/.github/workflows/archived-ta-tracker.yml @@ -0,0 +1,32 @@ +name: Archived TA tracker + +on: + workflow_dispatch: + schedule: + - cron: "17 7 * * *" + +permissions: + contents: read + issues: write + +jobs: + check-archived-tas: + runs-on: ubuntu-latest + steps: + - name: Check out repository + uses: actions/checkout@v7 + + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: "3.12" + + - name: Install YAML parser + run: python -m pip install PyYAML + + - name: Create or update archived TA issues + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_REF_NAME: ${{ github.ref_name }} + run: python scripts/check_archived_tas.py diff --git a/scripts/check_archived_tas.py b/scripts/check_archived_tas.py new file mode 100644 index 0000000000..020fa3f2d7 --- /dev/null +++ b/scripts/check_archived_tas.py @@ -0,0 +1,245 @@ +#!/usr/bin/env python3 +"""Create or refresh one GitHub issue for each archived TA in active use.""" + +from __future__ import annotations + +import json +import os +import re +import sys +import time +import urllib.error +import urllib.parse +import urllib.request +from pathlib import Path +from typing import Any + +import yaml + + +ROOT = Path(__file__).resolve().parents[1] +DATA_SOURCES_DIR = ROOT / "data_sources" +DETECTIONS_DIR = ROOT / "detections" +SPLUNKBASE_API = "https://splunkbase.splunk.com/api/v1/app" +APP_URL_PATTERN = re.compile( + r"https?://(?:www\.)?splunkbase\.splunk\.com/app/(\d+)(?:/|\b)", re.I +) +USER_AGENT = "splunk-threat-research-team/1.0" + + +def yaml_files(folder: Path): + yield from sorted(folder.rglob("*.yml")) + yield from sorted(folder.rglob("*.yaml")) + + +def load_yaml(path: Path) -> dict[str, Any] | None: + try: + value = yaml.safe_load(path.read_text(encoding="utf-8")) + except (OSError, yaml.YAMLError) as exc: + print(f"Warning: skipping {path.relative_to(ROOT)}: {exc}", file=sys.stderr) + return None + return value if isinstance(value, dict) else None + + +def discover_used_tas() -> dict[str, dict[str, Any]]: + """Return TAs grouped by app ID, including linked data sources/detections.""" + data_sources: dict[str, dict[str, Any]] = {} + for path in yaml_files(DATA_SOURCES_DIR): + obj = load_yaml(path) + if not obj or not isinstance(obj.get("name"), str): + continue + data_sources[obj["name"].strip().casefold()] = { + "name": obj["name"].strip(), + "path": path.relative_to(ROOT).as_posix(), + "supported_tas": obj.get("supported_TA") or [], + "detections": [], + } + + for path in yaml_files(DETECTIONS_DIR): + detection = load_yaml(path) + if not detection: + continue + references = detection.get("data_source") or [] + if isinstance(references, str): + references = [references] + if not isinstance(references, list): + continue + detection_name = str(detection.get("name") or path.stem) + detection_path = path.relative_to(ROOT).as_posix() + for reference in references: + if not isinstance(reference, str): + continue + source = data_sources.get(reference.strip().casefold()) + if source: + source["detections"].append({"name": detection_name, "path": detection_path}) + + tas: dict[str, dict[str, Any]] = {} + for source in data_sources.values(): + if not source["detections"]: + continue + for ta in source["supported_tas"]: + if not isinstance(ta, dict): + continue + url = str(ta.get("url") or "").strip() + match = APP_URL_PATTERN.search(url) + if not match: + continue + app_id = match.group(1) + name = str(ta.get("name") or f"Splunkbase app {app_id}").strip() + record = tas.setdefault( + app_id, + { + "app_id": app_id, + "name": name, + "url": f"https://splunkbase.splunk.com/app/{app_id}/", + "data_sources": {}, + }, + ) + if record["name"].startswith("Splunkbase app ") and name: + record["name"] = name + record["data_sources"][source["path"]] = source + return tas + + +def get_json(url: str) -> Any: + request = urllib.request.Request( + url, headers={"User-Agent": USER_AGENT, "Accept": "application/json"} + ) + with urllib.request.urlopen(request, timeout=30) as response: + return json.loads(response.read().decode("utf-8")) + + +def truthy(value: Any) -> bool: + if isinstance(value, str): + return value.strip().casefold() in {"true", "1", "yes", "archived"} + return value is True or value == 1 + + +def splunkbase_archived(app_id: str) -> tuple[bool, str]: + url = f"{SPLUNKBASE_API}/{app_id}/" + payload = get_json(url) + if not isinstance(payload, dict): + raise ValueError("unexpected Splunkbase response") + archived = truthy(payload.get("is_archived")) or truthy(payload.get("archive_status")) + api_name = str(payload.get("title") or payload.get("name") or "").strip() + return archived, api_name + + +def github_request(method: str, url: str, token: str, body: dict[str, Any] | None = None) -> Any: + headers = { + "User-Agent": USER_AGENT, + "Accept": "application/vnd.github+json", + "Authorization": f"Bearer {token}", + "X-GitHub-Api-Version": "2022-11-28", + } + data = json.dumps(body).encode("utf-8") if body is not None else None + request = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=30) as response: + raw = response.read() + return json.loads(raw.decode("utf-8")) if raw else None + + +def list_repo_issues(repo: str, token: str) -> list[dict[str, Any]]: + """Read open and closed issues so an old issue can be reopened in place.""" + issues: list[dict[str, Any]] = [] + page = 1 + while True: + query = urllib.parse.urlencode({"state": "all", "per_page": 100, "page": page}) + payload = github_request("GET", f"https://api.github.com/repos/{repo}/issues?{query}", token) + if not isinstance(payload, list): + raise ValueError("unexpected GitHub issues response") + issues.extend(item for item in payload if isinstance(item, dict) and "pull_request" not in item) + if len(payload) < 100: + return issues + page += 1 + + +def issue_body(ta: dict[str, Any], repo: str, branch: str) -> str: + lines = [ + f"", + f"**Splunkbase TA:** [{ta['name']}]({ta['url']})", + "", + "This archived Splunkbase TA is referenced by data source objects used by detections.", + "", + "### Data source objects and detections", + ] + for source in sorted(ta["data_sources"].values(), key=lambda item: item["name"].casefold()): + source_url = f"https://github.com/{repo}/blob/{branch}/{source['path']}" + lines.append(f"- [{source['name']}]({source_url})") + detection_items = sorted(source["detections"], key=lambda item: item["name"].casefold()) + for detection in detection_items: + detection_url = f"https://github.com/{repo}/blob/{branch}/{detection['path']}" + lines.append(f" - Detection: [{detection['name']}]({detection_url})") + lines.extend(["", "_This issue is maintained automatically by the archived TA daily workflow._"]) + return "\n".join(lines) + + +def find_existing_issue(ta: dict[str, Any], issues: list[dict[str, Any]]) -> dict[str, Any] | None: + marker = f"" + marked = [issue for issue in issues if marker in str(issue.get("body") or "")] + if marked: + return next((issue for issue in marked if issue.get("state") == "open"), marked[0]) + + # Adopt a manually created issue only when its exact title and Splunkbase + # URL both match. This avoids conflating two apps that happen to share a name. + expected_title = f"{ta['name']} is archived on Splunkbase" + for issue in issues: + if issue.get("title") == expected_title and ta["url"] in str(issue.get("body") or ""): + return issue + return None + + +def main() -> int: + repo = os.environ.get("GITHUB_REPOSITORY", "").strip() + token = os.environ.get("GITHUB_TOKEN", "").strip() + branch = os.environ.get("GITHUB_REF_NAME", "develop").strip() + if not repo or not token: + print("GITHUB_REPOSITORY and GITHUB_TOKEN are required.", file=sys.stderr) + return 2 + + used_tas = discover_used_tas() + print(f"Found {len(used_tas)} distinct TAs referenced by data sources used in detections.") + issues = list_repo_issues(repo, token) + api_root = f"https://api.github.com/repos/{repo}/issues" + archived_count = 0 + + for app_id, ta in sorted(used_tas.items(), key=lambda item: item[1]["name"].casefold()): + try: + archived, api_name = splunkbase_archived(app_id) + except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, ValueError, json.JSONDecodeError) as exc: + print(f"Warning: could not check Splunkbase app {app_id}: {exc}", file=sys.stderr) + continue + if not archived: + continue + archived_count += 1 + if api_name: + ta["name"] = api_name + + title = f"{ta['name']} is archived on Splunkbase" + body = issue_body(ta, repo, branch) + existing = find_existing_issue(ta, issues) + try: + if existing: + issue_number = existing["number"] + result = github_request( + "PATCH", + f"{api_root}/{issue_number}", + token, + {"title": title, "body": body, "state": "open"}, + ) + action = "Updated/reopened" + else: + result = github_request("POST", api_root, token, {"title": title, "body": body}) + action = "Created" + issues.append(result) + print(f"{action} issue #{result['number']}: {title}") + except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, KeyError, TypeError) as exc: + print(f"Error: could not save issue for app {app_id}: {exc}", file=sys.stderr) + time.sleep(0.15) + + print(f"Archived TAs currently in use: {archived_count}") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) From cd8d8f8d98f109a151c14432c401ce7e9aa8ad7c Mon Sep 17 00:00:00 2001 From: kbouchard <47464052+kbouchardherjavecgroup@users.noreply.github.com> Date: Thu, 1 Oct 2026 08:50:57 -0700 Subject: [PATCH 126/164] added V4 of Generic Response plan (#4295) added V4 of Generic Response plan Co-authored-by: Nasreddine Bencherchali --- response_templates/GenericIncidentResponse_v4.json | 1 + 1 file changed, 1 insertion(+) create mode 100644 response_templates/GenericIncidentResponse_v4.json diff --git a/response_templates/GenericIncidentResponse_v4.json b/response_templates/GenericIncidentResponse_v4.json new file mode 100644 index 0000000000..b2368751a9 --- /dev/null +++ b/response_templates/GenericIncidentResponse_v4.json @@ -0,0 +1 @@ +{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "draft", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"} \ No newline at end of file From dd57ea01535eff5721a6a53192e1c0a17e37bdb0 Mon Sep 17 00:00:00 2001 From: kbouchard <47464052+kbouchardherjavecgroup@users.noreply.github.com> Date: Thu, 1 Oct 2026 12:14:27 -0700 Subject: [PATCH 127/164] Update GenericIncidentResponse_v4.json (#4308) updated from Draft to Published. --- response_templates/GenericIncidentResponse_v4.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/response_templates/GenericIncidentResponse_v4.json b/response_templates/GenericIncidentResponse_v4.json index b2368751a9..4d0deb9172 100644 --- a/response_templates/GenericIncidentResponse_v4.json +++ b/response_templates/GenericIncidentResponse_v4.json @@ -1 +1 @@ -{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "draft", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"} \ No newline at end of file +{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "published", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"} From 1d0d226f4c310b13cf3176c238755d54cb1a0dee Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 2 Oct 2026 02:43:32 -0700 Subject: [PATCH 128/164] Update data source TA and install.yml app versions (#4309) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- install.yml | 2 +- 63 files changed, 63 insertions(+), 63 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 6fd1fe38ab..177d51fa85 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 5ca8401b63..801a3882ea 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index f74d5622d5..e725a27c95 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 771112afc1..9ce661d969 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index a6cec23c06..87c2702b27 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 2ff6e5b714..1c5f94ecab 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 4a3d0da170..042284fe75 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index b0d5da0175..90d25a6c4b 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index d0438d39af..66946e9161 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 6a3bc6f3c0..e9c79a8b1a 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index c63acbb7ec..c1153a3068 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index e66f77171f..00c450ca5d 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index c1b0c920e4..621812b8ec 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index 5288b8cbd4..f84b2cf002 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 47342a57d8..bcc8f0593c 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index 9e8c0336a0..9c87fc438a 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index f328e4afb8..4364c10000 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 81b65bfb0d..9aa2841257 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 9dd19beb76..39d29d1a6f 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index eaaed2c844..d190093d91 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index bcf5a76f98..bcf4fd5f84 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 8ca44cb904..6cb149284f 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 86bd7aab68..0bacc4bbb4 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 206581102a..d8aa0af29a 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 45377a711c..32a576295d 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 9f3946121a..fb8e5147f6 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index c7139fe37e..6518df5b56 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index c0350a4711..26b3ce7198 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 8b3f877fa3..f5c3a384fe 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index eaf32e0d25..95f67eb714 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 9a977502fa..888baf1d85 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index 73fae76c7d..e8eb028bb9 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 0ff1b8bf84..2a0af88997 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index 124ec4fdcd..bd587aed86 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index b970da776a..3d389b31f6 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 1cef1f3cee..5aa835619d 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 435cf6402e..191afb2bce 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 2130bc1392..e31315d18c 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index b66fcd5be4..27e9e0b3f1 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 954e0181fb..160dfe1db5 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 7e6ef7089f..4c419b3a63 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index d2595753a7..d2d1b63ce6 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index d18e6de7ea..c421ba7cb9 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 8fa3955282..f3898a6679 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 82d2e09109..3613f843e8 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 5391f2dc6f..4d47df2492 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 72d8807974..1027f7c5f2 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index a2c348f7a8..4877ea119c 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index 5d3dd4b85a..daa93d4c05 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index 9eca348610..452914db25 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 8a52e1dd16..ebcd3e95b4 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index dae12350ea..d95a8e337f 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 3f1d2fd448..57b95d703a 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 85693fd2c7..40e4c9ae5d 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 188e83923b..83e554a5ca 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index c7bbbe699d..de9423c9c5 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 559857b474..106b623c2c 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index b9140c0c4b..f62c9e6417 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 613fcc7750..e8c6c5ae94 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index a5c3a3a362..c609919c95 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index 62efe79121..b165f0ace8 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.3.0 + version: 8.2.2 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index e6f4e5bc3d..64fc6abb3b 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - AwsAccountId diff --git a/install.yml b/install.yml index f031247a96..28ef2c7679 100644 --- a/install.yml +++ b/install.yml @@ -3,7 +3,7 @@ apps: hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz - appid: SplunkEnterpriseSecuritySuite url: https://splunkbase.splunk.com/app/263 - version: 8.7.0 + version: 8.7.1 - appid: Splunk_TA_microsoft-iis url: https://splunkbase.splunk.com/app/3185 version: 2.0.0 From f4866a01c182468c60ac9f3223fa594e0cc17a3e Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 2 Oct 2026 12:09:41 +0200 Subject: [PATCH 129/164] Bump contentctl.yml and build.yml to 6.8.0 (#4311) * Update build.yml * Update contentctl.yml --- build.yml | 2 +- contentctl.yml | 2 +- .../detections}/detect_f5_tmui_rce_cve_2020_5902.yml | 4 ++-- .../detections}/linux_adding_crontab_using_list_parameter.yml | 4 ++-- .../detections}/lolbas_with_network_traffic.yml | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) rename {detections/deprecated => removed/detections}/detect_f5_tmui_rce_cve_2020_5902.yml (97%) rename {detections/deprecated => removed/detections}/linux_adding_crontab_using_list_parameter.yml (98%) rename {detections/deprecated => removed/detections}/lolbas_with_network_traffic.yml (99%) diff --git a/build.yml b/build.yml index c3377966ae..5a6a252bb0 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.7.0 +app_version: 6.8.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index 1ffa66afde..e6c1aceb7c 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.7.0 + version: 6.8.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU diff --git a/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml b/removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml similarity index 97% rename from detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml rename to removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml index 657033ef5a..0d8c5cdcc7 100644 --- a/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml +++ b/removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml @@ -2,9 +2,9 @@ name: Detect F5 TMUI RCE CVE-2020-5902 id: 810e4dbc-d46e-11ea-87d0-0242ac130003 version: 10 creation_date: '2020-08-04' -modification_date: '2026-08-10' +modification_date: '2026-10-02' author: Shannon Davis, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902. It uses regex to detect patterns in syslog data that match known exploit strings such as "hsqldb;" and directory traversal sequences. This activity is significant because successful exploitation can allow attackers to execute arbitrary commands on the affected devices, leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, or further lateral movement within the network. data_source: [] diff --git a/detections/deprecated/linux_adding_crontab_using_list_parameter.yml b/removed/detections/linux_adding_crontab_using_list_parameter.yml similarity index 98% rename from detections/deprecated/linux_adding_crontab_using_list_parameter.yml rename to removed/detections/linux_adding_crontab_using_list_parameter.yml index 6c550de21d..c2f250d80a 100644 --- a/detections/deprecated/linux_adding_crontab_using_list_parameter.yml +++ b/removed/detections/linux_adding_crontab_using_list_parameter.yml @@ -2,9 +2,9 @@ name: Linux Adding Crontab Using List Parameter id: 52f6d751-1fd4-4c74-a4c9-777ecfeb5c58 version: 12 creation_date: '2021-12-21' -modification_date: '2026-09-03' +modification_date: '2026-10-02' author: Teoderick Contreras, Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects suspicious modifications to cron jobs on Linux systems using the crontab command with list parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt to establish persistence or execute malicious code on a schedule. If confirmed malicious, the impact could include unauthorized code execution, data destruction, or other damaging outcomes. Further investigation should analyze the added cron job, its associated command, and any related processes. data_source: diff --git a/detections/deprecated/lolbas_with_network_traffic.yml b/removed/detections/lolbas_with_network_traffic.yml similarity index 99% rename from detections/deprecated/lolbas_with_network_traffic.yml rename to removed/detections/lolbas_with_network_traffic.yml index 0910406a7c..43a341fe4e 100644 --- a/detections/deprecated/lolbas_with_network_traffic.yml +++ b/removed/detections/lolbas_with_network_traffic.yml @@ -2,9 +2,9 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 version: 19 creation_date: '2023-02-02' -modification_date: '2026-08-24' +modification_date: '2026-10-02' author: Steven Dick -status: deprecated +status: removed type: TTP description: The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently used to download malicious payloads, enabling lateral movement, command-and-control, or data exfiltration. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security. data_source: From 3db0f548657e10f95191584270de291f55603463 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Fri, 2 Oct 2026 12:11:32 +0200 Subject: [PATCH 130/164] Deprecate Child Processes of spoolsv.exe detection (#4310) --------- Co-authored-by: Nasreddine Bencherchali --- .../child_processes_of_spoolsv_exe.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) rename detections/{endpoint => deprecated}/child_processes_of_spoolsv_exe.yml (88%) diff --git a/detections/endpoint/child_processes_of_spoolsv_exe.yml b/detections/deprecated/child_processes_of_spoolsv_exe.yml similarity index 88% rename from detections/endpoint/child_processes_of_spoolsv_exe.yml rename to detections/deprecated/child_processes_of_spoolsv_exe.yml index 8dcc2901ae..8caf4cabe3 100644 --- a/detections/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/deprecated/child_processes_of_spoolsv_exe.yml @@ -1,10 +1,10 @@ name: Child Processes of Spoolsv exe id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic identifies child processes spawned by spoolsv.exe, the Print Spooler service in Windows, which typically runs with SYSTEM privileges. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. Monitoring this activity is crucial as it can indicate exploitation attempts, such as those associated with CVE-2018-8440, which can lead to privilege escalation. If confirmed malicious, attackers could gain SYSTEM-level access, allowing them to execute arbitrary code, escalate privileges, and potentially compromise the entire system. data_source: @@ -57,3 +57,9 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: |- + Deprecated because the broad parent-child logic generated substantial legitimate printer, driver, and print-management activity and did not directly detect the exploitation behavior associated with its CVE reference. + More specific Print Spooler behaviors are covered by existing production detections. + removed_in_version: 6.10.0 + replacement_content: [] From dffaa04fc298b7097e6af54660f8f8a4d5d752ab Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 10:35:14 +0200 Subject: [PATCH 131/164] Update `how_to_implement` Section For NVM Content (#4281) --- ...er_spawned_unix_shell_with_external_connection.yml | 11 +++++------ ...cisco_nvm___curl_execution_with_insecure_flags.yml | 11 +++++------ ...___installation_of_typosquatted_python_package.yml | 11 +++++------ ..._or_mshta_network_execution_without_url_in_cli.yml | 11 +++++------ ...__non_network_binary_making_network_connection.yml | 11 +++++------ ...ascript_network_connection_for_a_long_duration.yml | 9 ++++----- ...o_nvm___outbound_connection_to_suspicious_port.yml | 11 +++++------ ...o_nvm___rclone_execution_with_network_activity.yml | 11 +++++------ ...dll32_abuse_of_mshtml_dll_for_payload_download.yml | 11 +++++------ ...cript_from_archive_triggering_network_activity.yml | 11 +++++------ ..._suspicious_download_from_file_sharing_website.yml | 11 +++++------ ..._suspicious_file_download_via_headless_browser.yml | 11 +++++------ ...s_network_connection_from_process_with_no_args.yml | 11 +++++------ ...picious_network_connection_initiated_via_msxsl.yml | 11 +++++------ ...us_network_connection_to_ip_lookup_service_api.yml | 11 +++++------ ...__webserver_download_from_file_sharing_website.yml | 11 +++++------ 16 files changed, 79 insertions(+), 95 deletions(-) diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml index 768ff926ec..15f820549c 100644 --- a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Browser Spawned Unix Shell with External Connection id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 -version: 1 +version: 2 creation_date: '2026-09-02' -modification_date: '2026-09-02' +modification_date: '2026-09-22' author: Maria Jose Erquiaga, Splunk status: production type: Anomaly @@ -60,14 +60,13 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations. references: diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 4f2287fd2b..4291c2f1be 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 -version: 8 +version: 9 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -45,14 +45,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___curl_execution_with_insecure_flags_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Usage of these flags to reach public IPs or uncommon destinations should be reviewed. Tuning may be required for domains with known certificate issues. diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index 1230dc1fe3..e9d3748c20 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Installation of Typosquatted Python Package id: 5e3f6b44-42cb-4f8a-99f0-59e78a52ea1d -version: 5 +version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -43,14 +43,13 @@ search: | process_integrity_level process_path process_name process_arguments process_hash process_id additional_logged_in_users_list module_name_list module_hash_list | `cisco_nvm___installation_of_typosquatted_python_package_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). In addition to this, the search make use of the lookup "typo_squatted_python_packages". Which needs to be configured and tuned. known_false_positives: | False positives should be very minimal to non existent, as the names of the packages in the lookup are all extracted from previously malicious packages. diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index 39f753ba7e..e2b0c93aa3 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -1,8 +1,8 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -48,14 +48,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | False positives should be minimal as the presence of a network connection during such executions increases the likelihood of malicious behavior. references: diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index 30d1478029..dc296fbfa2 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -46,14 +46,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___non_network_binary_making_network_connection_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Rare cases may exist where these binaries are used by plugins or third-party extensions to initiate outbound communication. However, such behavior is extremely uncommon and should be investigated for potential injection or abuse. diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index b30c5e3f41..1d63ae1c37 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Osascript Network Connection for a Long Duration id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 -version: 1 +version: 2 creation_date: '2026-09-18' -modification_date: '2026-09-18' +modification_date: '2026-09-22' author: Radka Viskova, Splunk status: production type: Anomaly @@ -46,11 +46,10 @@ search: |- how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: |- Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations. references: diff --git a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml index 012a98db4f..4fbd80b96e 100644 --- a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml +++ b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Outbound Connection to Suspicious Port id: fc32a8d5-bc79-4437-b48f-4646ab7bed9d -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -43,14 +43,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___outbound_connection_to_suspicious_port_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some legitimate applications may use high or non-standard ports, such as alternate SSH daemons or development tools. However, many of these ports are commonly used by threat actors for reverse shells or C2 communications. diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index d707ed4745..002d7f3c79 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a -version: 7 +version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -52,14 +52,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___rclone_execution_with_network_activity_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Rclone is used legitimately in some backup or other workflows. Tune this rule based on known-good operational usage or restrict by known user/service accounts an specific folders or remote names. references: diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index 3b0f0d51b9..c8caad0967 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -39,14 +39,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | `rundll32.exe` using `mshtml.dll` is rare in legitimate environments. However, edge cases might exist. Tuning may be needed in environments with custom automation scripts. references: diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index 0072fc506e..d98e0f72d8 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -39,14 +39,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___susp_script_from_archive_triggering_network_activity_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some software installers or automation scripts may extract and run scripts from archive files in temporary directories. However, it is uncommon for such scripts to initiate outbound network connections immediately upon extraction. diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 88bfa5cba7..2d0f030e05 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 -version: 7 +version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -54,14 +54,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_download_from_file_sharing_website_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some system administrators or development teams may use tools like curl or PowerShell to download files from public services for legitimate automation or scripting purposes. However, use of these binaries to contact domains commonly associated with file sharing or temporary hosting diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index 7ea531ccb1..9e5dd3c33f 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -74,14 +74,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_file_download_via_headless_browser_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some internal automation frameworks may invoke Chromium browsers in headless mode to programmatically access internal services or webpages. These tools may occasionally download legitimate resources as part of their normal behavior. diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index 30cb586fc2..f2e4760a56 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -49,14 +49,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_from_process_with_no_args_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some system binaries may execute without arguments in rare legitimate scenarios (e.g., certain service launches), and initiate a network connection to microsoft servers for telemetry or update purposes. Apply additional filters as needed. diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index 8fe5860f2b..e4cc59a7ea 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -43,14 +43,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_initiated_via_msxsl_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | False positives may occur in development or administrative environments where msxsl.exe is used for legitimate XML transformations. However, its use is uncommon in standard user activity diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index 681ce03876..c7c2ad43c3 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f -version: 8 +version: 9 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe status: production type: Anomaly @@ -53,14 +53,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Internal scripts or agents performing network checks may query IP geolocation services. Tune by excluding known tools or adding internal allowlists for destination domains or process names and commandlines. diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index bdcf425a92..f1360e9e90 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e -version: 7 +version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -46,14 +46,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___webserver_download_from_file_sharing_website_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | In rare cases, a web server may make outbound connections to pull content for legitimate purposes (e.g., downloading templates or updates from a trusted source). However, communication to anonymous file-sharing or temporary content domains is strongly suspicious. From 9c941e6ecc2806806dcb808d1d92885f230942df Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 10:40:16 +0200 Subject: [PATCH 132/164] Add Missing `local=t` From Lookup Calls (#4282) --- .../azure_ad_privileged_role_assigned.yml | 6 +- ...ged_role_assigned_to_service_principal.yml | 6 +- .../cloud/circle_ci_disable_security_job.yml | 6 +- ...alls_from_previously_unseen_user_roles.yml | 6 +- ...ance_created_by_previously_unseen_user.yml | 6 +- ...ce_created_in_previously_unused_region.yml | 6 +- ...e_created_with_previously_unseen_image.yml | 6 +- ...d_with_previously_unseen_instance_type.yml | 6 +- ...nce_modified_by_previously_unseen_user.yml | 6 +- ...g_activity_from_previously_unseen_city.yml | 6 +- ...ctivity_from_previously_unseen_country.yml | 6 +- ...vity_from_previously_unseen_ip_address.yml | 6 +- ...activity_from_previously_unseen_region.yml | 6 +- .../cloud/kubernetes_nginx_ingress_lfi.yml | 6 +- .../o365_bec_email_hiding_rule_created.yml | 6 +- .../cloud/o365_privileged_role_assigned.yml | 6 +- ...ged_role_assigned_to_service_principal.yml | 6 +- .../endpoint/attacker_tools_on_endpoint.yml | 6 +- ...llation_of_typosquatted_python_package.yml | 2 +- ...outbound_connection_to_suspicious_port.yml | 2 +- .../endpoint/common_ransomware_extensions.yml | 9 +- ...tect_remote_access_software_usage_file.yml | 6 +- ..._remote_access_software_usage_fileinfo.yml | 6 +- ...t_remote_access_software_usage_process.yml | 6 +- ..._remote_access_software_usage_registry.yml | 6 +- .../first_time_seen_child_process_of_zoom.yml | 6 +- .../potential_password_in_username.yml | 6 +- ...rocesses_run_from_unexpected_locations.yml | 6 +- .../windows_ad_adminsdholder_acl_modified.yml | 6 +- ...ows_ad_dangerous_deny_acl_modification.yml | 6 +- ...ws_ad_dangerous_group_acl_modification.yml | 6 +- ...ows_ad_dangerous_user_acl_modification.yml | 6 +- ...ws_ad_dcshadow_privileges_acl_addition.yml | 18 +- ...omain_controller_audit_policy_disabled.yml | 6 +- ...ows_ad_domain_replication_acl_addition.yml | 14 +- .../windows_ad_domain_root_acl_deletion.yml | 6 +- ...indows_ad_domain_root_acl_modification.yml | 6 +- .../windows_ad_gpo_new_cse_addition.yml | 6 +- .../windows_ad_hidden_ou_creation.yml | 6 +- .../windows_ad_object_owner_updated.yml | 16 +- ...rivileged_account_sid_history_addition.yml | 6 +- ...ndows_ad_privileged_group_modification.yml | 6 +- .../windows_ad_self_dacl_assignment.yml | 18 +- .../windows_ai_platform_dns_query.yml | 6 +- .../windows_applocker_block_events.yml | 6 +- ...ege_escalation_via_unauthorized_bypass.yml | 6 +- ...ndows_attempt_to_stop_security_service.yml | 6 +- ...ial_access_from_browser_password_store.yml | 40 +- .../windows_defender_asr_audit_events.yml | 52 +- .../windows_defender_asr_block_events.yml | 56 +- ...ows_defender_asr_registry_modification.yml | 6 +- .../windows_defender_asr_rule_disabled.yml | 6 +- .../windows_defender_asr_rules_stacking.yml | 6 +- ...earch_order_hijacking_hunt_with_sysmon.yml | 6 +- ...s_domain_admin_impersonation_indicator.yml | 6 +- ...ows_dotnet_binary_in_non_standard_path.yml | 8 +- .../endpoint/windows_hosts_file_access.yml | 6 +- .../windows_identify_protocol_handlers.yml | 6 +- ...indows_important_audit_policy_disabled.yml | 6 +- ...indows_kerberos_local_successful_logon.yml | 6 +- .../windows_known_abused_dll_created.yml | 6 +- ...s_known_abused_dll_loaded_suspiciously.yml | 130 +- ...indows_lolbas_executed_as_renamed_file.yml | 6 +- ..._lolbas_executed_outside_expected_path.yml | 8 +- .../endpoint/windows_nirsoft_utilities.yml | 6 +- ...wershell_process_with_malicious_string.yml | 6 +- ...ell_script_block_with_malicious_string.yml | 6 +- .../endpoint/windows_pua_named_pipe.yml | 6 +- .../endpoint/windows_rmm_named_pipe.yml | 6 +- ...scheduled_task_with_suspicious_command.yml | 6 +- ...ws_scheduled_task_with_suspicious_name.yml | 6 +- ...e_created_with_suspicious_service_name.yml | 6 +- .../windows_suspicious_c2_named_pipe.yml | 6 +- .../windows_suspicious_named_pipe.yml | 6 +- .../windows_vulnerable_driver_installed.yml | 6 +- .../windows_vulnerable_driver_loaded.yml | 6 +- ...supply_chain_attack_network_indicators.yml | 6 +- ...e_firewall___binary_file_type_download.yml | 6 +- ...lacklisted_ssl_certificate_fingerprint.yml | 6 +- ...all___file_download_over_uncommon_port.yml | 6 +- ...___intrusion_events_by_threat_activity.yml | 8 +- ...ure_firewall___malware_file_downloaded.yml | 6 +- ...__remote_access_software_usage_traffic.yml | 6 +- ..._firewall___repeated_malware_downloads.yml | 6 +- ...connecting_to_dynamic_domain_providers.yml | 8 +- ...etect_remote_access_software_usage_dns.yml | 6 +- ...t_remote_access_software_usage_traffic.yml | 6 +- .../network/http_c2_framework_user_agent.yml | 6 +- .../network/http_malware_user_agent.yml | 6 +- detections/network/http_pua_user_agent.yml | 6 +- detections/network/http_rmm_user_agent.yml | 6 +- .../prohibited_network_traffic_allowed.yml | 6 +- ...etect_remote_access_software_usage_url.yml | 6 +- .../web/http_scripting_tool_user_agent.yml | 6 +- lookups/csv/hijacklibs_loaded.csv | 1736 ++++++++--------- macros/base64decode.yml | 6 +- ...emote_access_software_usage_exceptions.yml | 6 +- macros/suspicious_writes.yml | 6 +- 98 files changed, 1405 insertions(+), 1212 deletions(-) diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index d352b47e15..29ccd68bf8 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -1,8 +1,8 @@ name: Azure AD Privileged Role Assigned id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a -version: 16 +version: 17 creation_date: '2022-08-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP @@ -20,7 +20,7 @@ search: |- BY dest user src vendor_account vendor_product initiatedBy result role signature - | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description + | lookup local=t privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml index 7064e4b1e2..9640b9bc5d 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml @@ -1,8 +1,8 @@ name: Azure AD Privileged Role Assigned to Service Principal id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41 -version: 14 +version: 15 creation_date: '2023-04-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Splunk status: production type: TTP @@ -24,7 +24,7 @@ search: |- vendor_account vendor_product displayName initiatedBy result role signature - | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description + | lookup local=t privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml index 86c52cf751..22d5f05039 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/cloud/circle_ci_disable_security_job.yml @@ -1,8 +1,8 @@ name: Circle CI Disable Security Job id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 -version: 10 +version: 11 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Patrick Bareiss, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- | stats values(job_name) as job_names BY workflow_id workflow_name user commit_message url branch - | lookup mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job + | lookup local=t mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where mandatory_job_executed=0 diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index eacd8e6352..ddd55187d0 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -1,8 +1,8 @@ name: Cloud API Calls From Previously Unseen User Roles id: 2181ad1f-1e73-4d0c-9780-e8880482a08f -version: 11 +version: 12 creation_date: '2020-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- All_Changes.status=success BY All_Changes.user, All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUserApiCall=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index c6b2f67045..223a8926b2 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created By Previously Unseen User id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 -version: 12 +version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=created BY All_Changes.user All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 1e909aad75..9d8da86c8e 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created In Previously Unused Region id: fa4089e2-50e3-40f7-8469-d2cc1564ca59 -version: 10 +version: 11 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=created BY All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index acb3a1e5c8..98bcc0d7b3 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created With Previously Unseen Image id: bc24922d-987c-4645-b288-f8c73ec194c4 -version: 10 +version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" - | lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 3ff282b40b..d627740476 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created With Previously Unseen Instance Type id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda -version: 11 +version: 12 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -26,7 +26,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where instance_type != "unknown" - | lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenInstanceType=min(firstTimeSeen) diff --git a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml index 9a90486c1b..2ff5d407c1 100644 --- a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml @@ -1,8 +1,8 @@ name: Cloud Instance Modified By Previously Unseen User id: 7fb15084-b14e-405a-bd61-a6de15a40722 -version: 12 +version: 13 creation_date: '2020-11-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success BY All_Changes.user | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml index 19fb7fd7ce..986561019d 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen City id: e7ecc5e0-88df-48b9-91af-51104c68f02f -version: 9 +version: 10 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) - | lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCity=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml index b88a241026..a59431fb49 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen Country id: 94994255-3acf-4213-9b3f-0494df03bb31 -version: 9 +version: 10 creation_date: '2020-12-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) - | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml index c66d7cbe66..94db84a678 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen IP Address id: f86a8ec9-b042-45eb-92f4-e9ed1d781078 -version: 9 +version: 10 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- All_Changes.status=success BY All_Changes.src, All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml index 68b6adb810..ecd39cf37d 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen Region id: 5aba1860-9617-4af9-b19d-aecac16fe4f2 -version: 9 +version: 10 creation_date: '2020-10-26' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region) - | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 93c1f49678..0cc3b3e343 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -1,14 +1,14 @@ name: Kubernetes Nginx Ingress LFI id: 0f83244b-425b-4528-83db-7a88c5f66e48 -version: 11 +version: 12 creation_date: '2021-08-23' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Patrick Bareiss, Splunk status: production type: TTP description: The following analytic detects local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. It leverages Kubernetes logs, parsing fields such as `request` and `status` to identify suspicious patterns indicative of LFI attempts. This activity is significant because LFI attacks can allow attackers to read sensitive files from the server, potentially exposing critical information. If confirmed malicious, this could lead to unauthorized access to sensitive data, further exploitation, and potential compromise of the Kubernetes environment. data_source: [] -search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local=t local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/cloud/o365_bec_email_hiding_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml index 7887386766..de038e494d 100644 --- a/detections/cloud/o365_bec_email_hiding_rule_created.yml +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -1,8 +1,8 @@ name: O365 BEC Email Hiding Rule Created id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 -version: 8 +version: 9 creation_date: '2025-02-14' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: '0xC0FFEEEE, Github Community' status: production type: TTP @@ -13,7 +13,7 @@ search: |- | stats min(_time) as firstTime, max(_time) as lastTime, values(Operation) as Operation, latest(Name) as Name, latest(MarkAsRead) as MarkAsRead, latest(MoveToFolder) as MoveToFolder by object_id user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup ut_shannon_lookup word as Name + | lookup local=t ut_shannon_lookup word as Name | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval read_score=if(MarkAsRead="True", 1, 0) diff --git a/detections/cloud/o365_privileged_role_assigned.yml b/detections/cloud/o365_privileged_role_assigned.yml index 75a8eaf325..f4680f055f 100644 --- a/detections/cloud/o365_privileged_role_assigned.yml +++ b/detections/cloud/o365_privileged_role_assigned.yml @@ -1,15 +1,15 @@ name: O365 Privileged Role Assigned id: db435700-4ddc-4c23-892e-49e7525d7d39 -version: 11 +version: 12 creation_date: '2024-04-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment. This detection leverages the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators will legitimately assign the privileged roles users as part of administrative tasks. Microsoft Privileged Identity Management (PIM) may cause false positives / less accurate alerting. references: diff --git a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml index 3ccfbf7cbf..ffeaa95712 100644 --- a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml @@ -1,15 +1,15 @@ name: O365 Privileged Role Assigned To Service Principal id: 80f3fc1b-705f-4080-bf08-f61bf013b900 -version: 11 +version: 12 creation_date: '2024-04-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals. This detection leverages the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators may legitimately assign the privileged roles to Service Principals as part of administrative tasks. Filter as needed. references: diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 2f1379ec50..57ab16b66d 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,8 +1,8 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 19 +version: 20 creation_date: '2021-07-12' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Bhavin Patel, Splunk, sventec, Github Community status: production type: TTP @@ -42,7 +42,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup attacker_tools attacker_tool_names AS process_name OUTPUT description + | lookup local=t attacker_tools attacker_tool_names AS process_name OUTPUT description | search description !=false | `attacker_tools_on_endpoint_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index e9d3748c20..7784dec31a 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -21,7 +21,7 @@ search: | (process_arguments = "*poetry*" process_arguments = "*add*") ) | rex field=process_arguments "(?i)(?:pip|poetry)[^|]*?\s+(?:install|add)\s+(?P[^\s\"']+)$" - | lookup typo_squatted_python_packages + | lookup local=t typo_squatted_python_packages typosquatted_package_name as package_name OUTPUTNEW comment package_official_url | where isnotnull(comment) diff --git a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml index 4fbd80b96e..61d00ba116 100644 --- a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml +++ b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml @@ -33,7 +33,7 @@ search: | values(aliul) as additional_logged_in_users_list values(dest_hostname) as dest_hostname by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport - | lookup suspicious_ports_list dest_port OUTPUTNEW comment as dest_port_metadata confidence as dest_confidence category as dest_port_category + | lookup local=t suspicious_ports_list dest_port OUTPUTNEW comment as dest_port_metadata confidence as dest_confidence category as dest_port_category | where isnotnull(dest_port_metadata) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 8f922873d4..7fb53d11a5 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,8 +1,8 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: 22 +version: 23 creation_date: '2019-10-16' -modification_date: '2026-07-02' +modification_date: '2026-09-22' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick status: production type: TTP @@ -56,7 +56,7 @@ search: | Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | rex field=file_name "(?(\.[^\.]+){1,2})$" - | lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name + | lookup local=t update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name | search Name !=False | stats min(firstTime) as firstTime max(lastTime) as lastTime @@ -105,6 +105,9 @@ intermediate_findings: type: system score: 50 message: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack. +threat_objects: + - field: file_path + type: file_path analytic_story: - Rhysida Ransomware - Prestige Ransomware diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index 6c971f45ac..0746d33835 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage File id: 3bf5541a-6a45-4fdc-b01d-59b899fff961 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -40,7 +40,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Filesystem)` - | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_file_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index 2c3579d0b6..b7e8eb806b 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage FileInfo id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454 -version: 15 +version: 16 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- process_hash process_id process_integrity_level process_name process_path user user_id vendor_product - | lookup remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_fileinfo_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index 49afb5a484..b80e1ec8b9 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick, Sebastian Wurl, Splunk Community status: production type: Anomaly @@ -24,7 +24,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category + | lookup local=t remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml index 3d9d5dfbde..f000f5d3d4 100644 --- a/detections/endpoint/detect_remote_access_software_usage_registry.yml +++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml @@ -1,15 +1,15 @@ name: Detect Remote Access Software Usage Registry id: 33804986-25dd-43cf-bb6b-dc14956c7cbc -version: 13 +version: 14 creation_date: '2024-12-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' +search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index 6f88871ef2..3c4b132b75 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -1,8 +1,8 @@ name: First Time Seen Child Process of Zoom id: e91bd102-d630-4e76-ab73-7e3ba22c5961 -version: 11 +version: 12 creation_date: '2020-05-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: experimental type: Anomaly @@ -20,7 +20,7 @@ search: |- ) BY Processes.process_id Processes.dest | `drop_dm_object_name(Processes)` - | lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen + | lookup local=t zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`") | `security_content_ctime(firstTime)` | `first_time_seen_child_process_of_zoom_filter` diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index e6fb5a7cbe..0664911116 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -1,8 +1,8 @@ name: Potential password in username id: 5ced34b4-ab32-4bb0-8f22-3b8f186f0a38 -version: 8 +version: 9 creation_date: '2022-05-27' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mikael Bjerkeland, Splunk status: production type: Hunting @@ -14,7 +14,7 @@ search: |- WHERE nodename=Authentication.Failed_Authentication BY "Authentication.user" | `drop_dm_object_name(Authentication)` - | lookup ut_shannon_lookup word AS user + | lookup local=t ut_shannon_lookup word AS user | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 | sort count, - ut_shannon | eval incorrect_cred=user diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 4404c793fd..34973c0d0a 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -1,8 +1,8 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d -version: 17 +version: 18 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -35,7 +35,7 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile + | lookup local=t update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true | `system_processes_run_from_unexpected_locations_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 9d6cd43a91..22272eb1e6 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -1,15 +1,15 @@ name: Windows AD AdminSDHolder ACL Modified id: 00d877c3-7b7b-443d-9562-6b231e2abab9 -version: 11 +version: 12 creation_date: '2022-11-15' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Dean Luxton, Splunk status: production type: TTP description: The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for the AdminSDHolder object in order to log modifications. known_false_positives: Adding new users or groups to the AdminSDHolder ACL is not usual. Filter as needed references: diff --git a/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml index 4c843d442b..2ec0999809 100644 --- a/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous Deny ACL Modification id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml index 496738c80c..bb3d90f628 100644 --- a/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous Group ACL Modification id: 59b0fc85-7a0d-4585-97ec-06a382801990 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: 'This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes", "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.' data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml index 953f11c028..efaba46b0d 100644 --- a/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous User ACL Modification id: ec5b6790-595a-4fb8-ad43-56e5b55a9617 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: 'This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes", "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.' data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml index 961b49dc71..6722e417c5 100644 --- a/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml @@ -1,8 +1,8 @@ name: Windows AD DCShadow Privileges ACL Addition id: ae915743-1aa8-4a94-975c-8062ebc8b723 -version: 11 +version: 12 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -22,13 +22,13 @@ search: |- | search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups + | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId BY ObjectClass ObjectDN src_user diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index a9de68376c..4ae8bbf823 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -1,8 +1,8 @@ name: Windows AD Domain Controller Audit Policy Disabled id: fc3ccef1-60a4-4239-bd66-b279511b4d14 -version: 12 +version: 13 creation_date: '2023-01-25' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -15,7 +15,7 @@ search: |- | eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID) | stats min(_time) as _time values(host) as dest BY AuditPolicyChanges SubcategoryGuid - | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory + | lookup local=t advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_ad_domain_controller_audit_policy_disabled_filter` how_to_implement: Ensure you are ingesting EventCode `4719` from your domain controllers, the category domain_controller exists in assets and identities, and that assets and identities is enabled. If A&I is not configured, you will need to manually filter the results within the base search. known_false_positives: No false positives have been identified at this time. diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index fa3da3a0fa..008078814a 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,8 +1,8 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab -version: 14 +version: 15 creation_date: '2022-11-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -22,11 +22,11 @@ search: |- | search aceObjectGuid IN ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2","1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","89e95b76-444d-4c62-991a-0facbeda640c") | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId BY ObjectClass ObjectDN src_user dest user diff --git a/detections/endpoint/windows_ad_domain_root_acl_deletion.yml b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml index 3d8f5ea920..f4c529ed51 100644 --- a/detections/endpoint/windows_ad_domain_root_acl_deletion.yml +++ b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml @@ -1,15 +1,15 @@ name: Windows AD Domain Root ACL Deletion id: 3cb56e57-5642-4638-907f-8dfde9afb889 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand old_values | where NOT old_values IN (new_values) | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand old_values | where NOT old_values IN (new_values) | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_domain_root_acl_modification.yml b/detections/endpoint/windows_ad_domain_root_acl_modification.yml index dd7f05a1ec..e3e9320ce7 100644 --- a/detections/endpoint/windows_ad_domain_root_acl_modification.yml +++ b/detections/endpoint/windows_ad_domain_root_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Domain Root ACL Modification id: 4981e2db-1372-440d-816e-3e7e2ed74433 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_gpo_new_cse_addition.yml b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml index ee01fe92ec..7ee0d8c86b 100644 --- a/detections/endpoint/windows_ad_gpo_new_cse_addition.yml +++ b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml @@ -1,8 +1,8 @@ name: Windows AD GPO New CSE Addition id: 700c11d1-da09-47b2-81aa-358c143c7986 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -24,7 +24,7 @@ search: |- | \d]+\-[A-Z | \d]+\-[A-Z | \d]+\}") - | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType + | lookup local=t msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType | eval newPolicy=if(policyType like "%",policyType,new_values) | join ObjectDN [ | search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update diff --git a/detections/endpoint/windows_ad_hidden_ou_creation.yml b/detections/endpoint/windows_ad_hidden_ou_creation.yml index 753e995803..f3b1f2b8cc 100644 --- a/detections/endpoint/windows_ad_hidden_ou_creation.yml +++ b/detections/endpoint/windows_ad_hidden_ou_creation.yml @@ -1,15 +1,15 @@ name: Windows AD Hidden OU Creation id: 66b6ad5e-339a-40af-b721-dacefc7bdb75 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_object_owner_updated.yml b/detections/endpoint/windows_ad_object_owner_updated.yml index b242e6adef..d26cae513b 100644 --- a/detections/endpoint/windows_ad_object_owner_updated.yml +++ b/detections/endpoint/windows_ad_object_owner_updated.yml @@ -1,8 +1,8 @@ name: Windows AD Object Owner Updated id: 4af01f6b-d8d4-4f96-8635-758a01557130 -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -17,12 +17,12 @@ search: |- | rex field=old_value "O:(?P.*?)G:" | rex field=new_value "O:(?P.*?)G:" | where old_owner!=new_owner ``` optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user - | lookup admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group - | lookup identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user - | lookup admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group ``` - | lookup builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group - | lookup builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group + | lookup local=t identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user + | lookup local=t admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group + | lookup local=t identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user + | lookup local=t admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group ``` + | lookup local=t builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group + | lookup local=t builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner) | stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId BY _time ObjectClass ObjectDN diff --git a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml index 49124a7713..4d065865c8 100644 --- a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml @@ -1,8 +1,8 @@ name: Windows AD Privileged Account SID History Addition id: 6b521149-b91c-43aa-ba97-c2cac59ec830 -version: 13 +version: 14 creation_date: '2023-04-11' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -16,7 +16,7 @@ search: |- NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P.*?)(}$|$)" | eval category="privileged" - | lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match + | lookup local=t identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match | where isnotnull(match) | rename TargetSid as userSid | table _time action status host user userSid SidHistory Logon_ID src_user dest diff --git a/detections/endpoint/windows_ad_privileged_group_modification.yml b/detections/endpoint/windows_ad_privileged_group_modification.yml index bcfe2f7cef..0feccfdd2f 100644 --- a/detections/endpoint/windows_ad_privileged_group_modification.yml +++ b/detections/endpoint/windows_ad_privileged_group_modification.yml @@ -1,8 +1,8 @@ name: Windows AD Privileged Group Modification id: 187bf937-c436-4c65-bbcb-7539ffe02da1 -version: 11 +version: 12 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -20,7 +20,7 @@ search: |- `wineventlog_security` EventCode IN (4728) | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc BY signature, Group_Name,src_user dest - | lookup admon_groups_def cn as Group_Name OUTPUT category + | lookup local=t admon_groups_def cn as Group_Name OUTPUT category | where category="privileged" | `windows_ad_privileged_group_modification_filter` how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. See splunkbase app listed in the references for further details. diff --git a/detections/endpoint/windows_ad_self_dacl_assignment.yml b/detections/endpoint/windows_ad_self_dacl_assignment.yml index 086f99486a..cc4b4578cd 100644 --- a/detections/endpoint/windows_ad_self_dacl_assignment.yml +++ b/detections/endpoint/windows_ad_self_dacl_assignment.yml @@ -1,8 +1,8 @@ name: Windows AD Self DACL Assignment id: 16132445-da9f-4d03-ad44-56d717dcd67d -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -36,17 +36,17 @@ search: | | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group + | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType = coalesce(ace_type_value, aceType), aceInheritance = coalesce(ace_flag_value, "This object only"), diff --git a/detections/endpoint/windows_ai_platform_dns_query.yml b/detections/endpoint/windows_ai_platform_dns_query.yml index 60a3555327..64febb1b45 100644 --- a/detections/endpoint/windows_ai_platform_dns_query.yml +++ b/detections/endpoint/windows_ai_platform_dns_query.yml @@ -1,8 +1,8 @@ name: Windows AI Platform DNS Query id: 1ad89d24-c856-4a0e-8fdf-c20c7b9febe1 -version: 6 +version: 7 creation_date: '2025-08-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Sysmon EventID 22 search: | `sysmon` EventCode=22 QueryName IN ("router.huggingface.co", "api.openai.com") - | lookup update=true browser_app_list browser_process_name AS process_name OUTPUT isAllowed | search isAllowed!=true + | lookup local=t update=true browser_app_list browser_process_name AS process_name OUTPUT isAllowed | search isAllowed!=true | rename dvc as dest | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dest process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id Image diff --git a/detections/endpoint/windows_applocker_block_events.yml b/detections/endpoint/windows_applocker_block_events.yml index 35ba239a3b..e6acb3d585 100644 --- a/detections/endpoint/windows_applocker_block_events.yml +++ b/detections/endpoint/windows_applocker_block_events.yml @@ -1,8 +1,8 @@ name: Windows AppLocker Block Events id: e369afe8-cd35-47a3-9c1e-d813efc1f7dd -version: 10 +version: 11 creation_date: '2024-04-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- BY dest, PolicyName, RuleId, user, TargetProcessId, FilePath, FullFilePath, EventCode - | lookup applockereventcodes EventCode OUTPUT Description + | lookup local=t applockereventcodes EventCode OUTPUT Description | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_applocker_block_events_filter` diff --git a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml index 0af315282f..15e389f058 100644 --- a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml +++ b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml @@ -1,8 +1,8 @@ name: Windows AppLocker Privilege Escalation via Unauthorized Bypass id: bca48629-7fa2-40d3-9e5d-807564504e28 -version: 9 +version: 10 creation_date: '2024-04-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -18,7 +18,7 @@ search: |- FullFilePath, EventCode | where attempt_count > 5 | sort - attempt_count - | lookup applockereventcodes EventCode OUTPUT Description + | lookup local=t applockereventcodes EventCode OUTPUT Description | `windows_applocker_privilege_escalation_via_unauthorized_bypass_filter` how_to_implement: The analytic is designed to be run against Windows AppLocker event logs collected from endpoints with AppLocker enabled. If using Microsoft Defender for Endpoint (MDE), modify the analytic to use EventTypes/ActionTypes that match the block events for AppLocker. The analytic requires the AppLocker event logs to be ingested into Splunk. known_false_positives: False positives are possible if legitimate users are attempting to bypass application restrictions. This could occur if a user is attempting to run an application that is not permitted by AppLocker. It is recommended to investigate the context of the bypass attempt to determine if it is malicious or not. Modify the threshold as needed to reduce false positives. diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index c5c5036f1f..a0612d605f 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -1,8 +1,8 @@ name: Windows Attempt To Stop Security Service id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -29,7 +29,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup security_services_lookup service as process OUTPUTNEW category, description + | lookup local=t security_services_lookup service as process OUTPUTNEW category, description | search category=security | `windows_attempt_to_stop_security_service_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index 53e4dea2ce..694b94d393 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -1,15 +1,42 @@ name: Windows Credential Access From Browser Password Store id: 72013a8e-5cea-408a-9d51-5585386b4d69 -version: 23 +version: 24 creation_date: '2024-03-20' -modification_date: '2026-06-25' +modification_date: '2026-09-22' author: Teoderick Contreras, Bhavin Patel Splunk status: production type: Anomaly -description: The following analytic identifies a possible non-common browser process accessing its browser user data profile. This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles. +description: |- + The following analytic identifies a possible non-common browser process accessing its browser user data profile. + This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. + Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. + This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 | stats count by _time object_file_path object_file_name dest process_name process_path process_id EventCode | lookup browser_app_list browser_object_path as object_file_path OUTPUT browser_process_name isAllowed | stats count min(_time) as firstTime max(_time) as lastTime values(object_file_name) values(object_file_path) values(browser_process_name) as browser_process_name by dest process_name process_path process_id EventCode isAllowed | rex field=process_name "(?[^\\\\]+)$" | eval isMalicious=if(match(browser_process_name, extracted_process_name), "0", "1") | where isMalicious=1 and isAllowed="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credential_access_from_browser_password_store_filter`' +search: |- + `wineventlog_security` + EventCode=4663 + + | stats count by _time object_file_path object_file_name + dest process_name + process_path process_id EventCode + + | lookup local=t browser_app_list browser_object_path as object_file_path OUTPUT browser_process_name isAllowed + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(object_file_name) + values(object_file_path) + values(browser_process_name) as browser_process_name + by dest process_name process_path process_id EventCode isAllowed + + | rex field=process_name "(?[^\\\\]+)$" + | eval isMalicious=if(match(browser_process_name, extracted_process_name), "0", "1") + | where isMalicious=1 and isAllowed="false" + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credential_access_from_browser_password_store_filter` how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file. known_false_positives: The lookup file `browser_app_list` may not contain all the browser applications that are allowed to access the browser user data profiles. Consider updating the lookup files to add allowed object paths for the browser applications that are not included in the lookup file. references: @@ -29,7 +56,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A non-common browser process $process_name$ accessing browser user data folder on $dest$ + message: A non-common browser process [$process_name$] accessing browser user data folder on $dest$ +threat_objects: + - field: process_name + type: process_name analytic_story: - StealC Stealer - Salt Typhoon diff --git a/detections/endpoint/windows_defender_asr_audit_events.yml b/detections/endpoint/windows_defender_asr_audit_events.yml index f6983833e1..ad27379523 100644 --- a/detections/endpoint/windows_defender_asr_audit_events.yml +++ b/detections/endpoint/windows_defender_asr_audit_events.yml @@ -1,33 +1,46 @@ name: Windows Defender ASR Audit Events id: 0e4d46b1-22bd-4f0e-8337-ca6f60ad4bea -version: 9 +version: 10 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly -description: This detection searches for Windows Defender ASR audit events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes. +description: |- + This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes. data_source: - Windows Event Log Defender 1122 - Windows Event Log Defender 1125 - - Windows Event Log Defender 1126 - Windows Event Log Defender 1132 - Windows Event Log Defender 1134 search: |- - `ms_defender` EventCode IN (1122, 1125, 1126, 1132, 1134) - | stats count min(_time) as firstTime max(_time) as lastTime - BY host, Process_Name, Target_Commandline, - Path, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule - | fillnull value=NULL - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | rename host as dest - | `windows_defender_asr_audit_events_filter` + `ms_defender` + EventCode IN ( + 1122, + 1125, + 1132, + 1134 + ) + | fillnull value=NULL + | stats count min(_time) as firstTime + max(_time) as lastTime + by host EventCode + Parent_Commandline Process_Name Target_Commandline + Path ID RuleType + + | lookup local=t asr_rules ID OUTPUT ASR_Rule + + | rename host as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_asr_audit_events_filter` how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. -known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 1122 is generated when a process attempts to load a DLL that is blocked by an ASR rule. This can be triggered by legitimate applications that attempt to load DLLs that are not blocked by ASR rules. This is audit only. +known_false_positives: |- + Some false positives are expected initially as the ASR rules are tuned and configured. references: - https://asrgen.streamlit.app/ + - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,7 +55,14 @@ intermediate_findings: - field: dest type: system score: 20 - message: ASR audit event, $ASR_Rule$, was triggered on $dest$. + message: The ASR audit event [$ASR_Rule$] was triggered on [$dest$]. +threat_objects: + - field: Parent_Commandline + type: parent_process + - field: Target_Commandline + type: process + - field: Process_Name + type: file_path analytic_story: - Windows Attack Surface Reduction asset_type: Endpoint diff --git a/detections/endpoint/windows_defender_asr_block_events.yml b/detections/endpoint/windows_defender_asr_block_events.yml index 8a05832e33..6d02f418c0 100644 --- a/detections/endpoint/windows_defender_asr_block_events.yml +++ b/detections/endpoint/windows_defender_asr_block_events.yml @@ -1,12 +1,14 @@ name: Windows Defender ASR Block Events id: 026f5f4e-e99f-4155-9e63-911ba587300b -version: 10 +version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly -description: This detection searches for Windows Defender ASR block events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. Set to TTP once tuned. +description: |- + This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. + Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. data_source: - Windows Event Log Defender 1121 - Windows Event Log Defender 1126 @@ -14,20 +16,35 @@ data_source: - Windows Event Log Defender 1131 - Windows Event Log Defender 1133 search: |- - `ms_defender` EventCode IN (1121, 1126, 1129, 1131, 1133) - | stats count min(_time) as firstTime max(_time) as lastTime - BY host, Path, Parent_Commandline, - Process_Name, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule - | fillnull value=NULL - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | rename host as dest - | `windows_defender_asr_block_events_filter` -how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. -known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 1122 is generated when a process attempts to load a DLL that is blocked by an ASR rule. This can be triggered by legitimate applications that attempt to load DLLs that are not blocked by ASR rules. This is block only. + `ms_defender` + EventCode IN ( + 1121, + 1126, + 1129, + 1131, + 1133 + ) + | fillnull value=NULL + | stats count min(_time) as firstTime + max(_time) as lastTime + by host EventCode + Parent_Commandline Process_Name Target_Commandline + Path ID RuleType + + | lookup local=t asr_rules ID OUTPUT ASR_Rule + + | rename host as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_asr_block_events_filter` +how_to_implement: |- + The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. +known_false_positives: |- + Some false positives are expected initially as the ASR rules are tuned and configured. references: - https://asrgen.streamlit.app/ + - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,7 +59,14 @@ intermediate_findings: - field: dest type: system score: 20 - message: ASR block event, $ASR_Rule$, was triggered on $dest$. + message: The ASR block event [$ASR_Rule$] was triggered on [$dest$]. +threat_objects: + - field: Parent_Commandline + type: parent_process + - field: Target_Commandline + type: process + - field: Process_Name + type: file_path analytic_story: - Windows Attack Surface Reduction asset_type: Endpoint diff --git a/detections/endpoint/windows_defender_asr_registry_modification.yml b/detections/endpoint/windows_defender_asr_registry_modification.yml index 627268ebe1..06c4bbcb8b 100644 --- a/detections/endpoint/windows_defender_asr_registry_modification.yml +++ b/detections/endpoint/windows_defender_asr_registry_modification.yml @@ -1,15 +1,15 @@ name: Windows Defender ASR Registry Modification id: 6a1b6cbe-6612-44c3-92b9-1a1bd77412eb -version: 8 +version: 9 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting description: The following analytic detects modifications to Windows Defender Attack Surface Reduction (ASR) registry settings. It leverages Windows Defender Operational logs, specifically EventCode 5007, to identify changes in ASR rules. This activity is significant because ASR rules are designed to block actions commonly used by malware to exploit systems. Unauthorized modifications to these settings could indicate an attempt to weaken system defenses. If confirmed malicious, this could allow an attacker to bypass security measures, leading to potential system compromise and data breaches. data_source: - Windows Event Log Defender 5007 -search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)` | `windows_defender_asr_registry_modification_filter`' +search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)` | `windows_defender_asr_registry_modification_filter`' how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 5007 is generated when a process attempts to modify a registry key that is related to ASR rules. This can be triggered by legitimate applications that attempt to modify registry keys that are not blocked by ASR rules. references: diff --git a/detections/endpoint/windows_defender_asr_rule_disabled.yml b/detections/endpoint/windows_defender_asr_rule_disabled.yml index 29f4af1a66..eed3e8b8c5 100644 --- a/detections/endpoint/windows_defender_asr_rule_disabled.yml +++ b/detections/endpoint/windows_defender_asr_rule_disabled.yml @@ -1,15 +1,15 @@ name: Windows Defender ASR Rule Disabled id: 429d611b-3183-49a7-b235-fc4203c4e1cb -version: 10 +version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP description: The following analytic identifies when a Windows Defender ASR rule disabled events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR rule disabled events that are generated when an ASR rule is disabled. data_source: - Windows Event Log Defender 5007 -search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | search New_Registry_Value="Disabled" | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`' +search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | search New_Registry_Value="Disabled" | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`' how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. known_false_positives: False positives may occur if applications are typically disabling ASR rules in the environment. Monitor for changes to ASR rules to determine if this is a false positive. references: diff --git a/detections/endpoint/windows_defender_asr_rules_stacking.yml b/detections/endpoint/windows_defender_asr_rules_stacking.yml index 780f6b1993..1f0d5b2928 100644 --- a/detections/endpoint/windows_defender_asr_rules_stacking.yml +++ b/detections/endpoint/windows_defender_asr_rules_stacking.yml @@ -1,8 +1,8 @@ name: Windows Defender ASR Rules Stacking id: 425a6657-c5e4-4cbb-909e-fc9e5d326f01 -version: 8 +version: 9 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -22,7 +22,7 @@ search: |- | stats count min(_time) as firstTime max(_time) as lastTime BY host Parent_Commandline, Process_Name, Path, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule + | lookup local=t asr_rules ID OUTPUT ASR_Rule | fillnull value=NULL | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index ce9a6ee981..f151287086 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -1,15 +1,15 @@ name: Windows DLL Search Order Hijacking Hunt with Sysmon id: 79c7d1fc-64c7-91be-a616-ccda752efe81 -version: 12 +version: 13 creation_date: '2022-08-19' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting description: The following analytic identifies potential DLL search order hijacking or DLL sideloading by detecting known Windows libraries loaded from non-standard directories. It leverages Sysmon EventCode 7 to monitor DLL loads and cross-references them with a lookup of known hijackable libraries. This activity is significant as it may indicate an attempt to execute malicious code by exploiting DLL search order vulnerabilities. If confirmed malicious, this could allow attackers to gain code execution, escalate privileges, or maintain persistence within the environment. data_source: - Sysmon EventID 7 -search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' +search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup local=t hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' how_to_implement: The search is written against the latest Sysmon TA 4.0 https://splunkbase.splunk.com/app/5709. For this specific event ID 7, the sysmon TA will extract the ImageLoaded name to the loaded_file field which is used in the search to compare against the hijacklibs lookup. known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed. Some applications may legitimately load libraries from non-standard paths. references: diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index bdd740f73b..5c0981bdc1 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -1,8 +1,8 @@ name: Windows Domain Admin Impersonation Indicator id: 10381f93-6d38-470a-9c30-d25478e3bd3f -version: 12 +version: 13 creation_date: '2023-10-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Splunk status: production type: TTP @@ -16,7 +16,7 @@ search: |- BY _time TargetUserName GroupMembership action app dest signature_id user vendor_product - | lookup domain_admins username as TargetUserName OUTPUT username + | lookup local=t domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA username | search username = "NotDA" | `windows_domain_admin_impersonation_indicator_filter` diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index bf5c2622dd..eee16bce84 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -1,8 +1,8 @@ name: Windows DotNet Binary in Non Standard Path id: fddf3b56-7933-11ec-98a6-acde48001122 -version: 14 +version: 15 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -45,8 +45,8 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_net_windows_file filename as process_name OUTPUT netFile - | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile + | lookup local=t update=true is_net_windows_file filename as process_name OUTPUT netFile + | lookup local=t update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true | `windows_dotnet_binary_in_non_standard_path_filter` how_to_implement: | diff --git a/detections/endpoint/windows_hosts_file_access.yml b/detections/endpoint/windows_hosts_file_access.yml index 04ee00db3d..accdd50bec 100644 --- a/detections/endpoint/windows_hosts_file_access.yml +++ b/detections/endpoint/windows_hosts_file_access.yml @@ -1,8 +1,8 @@ name: Windows Hosts File Access id: b34bcf35-5380-4b00-b208-5531303fb751 -version: 4 +version: 5 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,7 +29,7 @@ search: | by _time object_file_path object_file_name dest process_name process_path process_id EventCode | eval process_path = lower(process_path) - | lookup browser_process_and_path browser_process_path as process_path OUTPUT is_valid_browser_path + | lookup local=t browser_process_and_path browser_process_path as process_path OUTPUT is_valid_browser_path | eval is_valid_browser_path=coalesce(is_valid_browser_path,"false") | where is_valid_browser_path = "false" | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index a839ad2451..e6477a71bc 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -1,8 +1,8 @@ name: Windows Identify Protocol Handlers id: bd5c311e-a6ea-48ae-a289-19a3398e3648 -version: 10 +version: 11 creation_date: '2022-07-12' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -23,7 +23,7 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler + | lookup local=t windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE" | `windows_identify_protocol_handlers_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_important_audit_policy_disabled.yml b/detections/endpoint/windows_important_audit_policy_disabled.yml index b9eb4aba48..ad0f602c9e 100644 --- a/detections/endpoint/windows_important_audit_policy_disabled.yml +++ b/detections/endpoint/windows_important_audit_policy_disabled.yml @@ -1,8 +1,8 @@ name: Windows Important Audit Policy Disabled id: 1bf500e5-1226-41d9-af5d-ed1f577929f2 -version: 8 +version: 9 creation_date: '2025-02-19' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -16,7 +16,7 @@ search: |- | rename ClientProcessId as process_id | stats min(_time) as _time values(host) as dest BY AuditPolicyChanges SubcategoryGuid, process_id - | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory + | lookup local=t advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_important_audit_policy_disabled_filter` how_to_implement: To implement the following query, enable the audit policy sub category "Audit Audit Policy Change", and, ensure you are ingesting EventCode `4719` from your endpoints via the appropriate Splunk Add-on for Microsoft Windows. Update the macro definition with the an accurate list of Audit sub categories that you consider important for your environment. known_false_positives: No false positives have been identified at this time. diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml index f056478f50..af3fb83506 100644 --- a/detections/endpoint/windows_kerberos_local_successful_logon.yml +++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml @@ -1,8 +1,8 @@ name: Windows Kerberos Local Successful Logon id: 8309c3a8-4d34-48ae-ad66-631658214653 -version: 15 +version: 16 creation_date: '2022-04-28' -modification_date: '2026-07-27' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -31,7 +31,7 @@ search: |- src_port status subject user user_group vendor_product - | lookup update=true domain_controllers sAMAccountName as dest OUTPUT isDC + | lookup local=t update=true domain_controllers sAMAccountName as dest OUTPUT isDC | where isnull(isDC) | fields - isDC diff --git a/detections/endpoint/windows_known_abused_dll_created.yml b/detections/endpoint/windows_known_abused_dll_created.yml index 56dbfd3b2e..e480094ba5 100644 --- a/detections/endpoint/windows_known_abused_dll_created.yml +++ b/detections/endpoint/windows_known_abused_dll_created.yml @@ -1,15 +1,15 @@ name: Windows Known Abused DLL Created id: ea91651a-772a-4b02-ac3d-985b364a5f07 -version: 11 +version: 12 creation_date: '2024-03-20' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly description: The following analytic identifies the creation of Dynamic Link Libraries (DLLs) with a known history of exploitation in atypical locations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and filesystem events. This activity is significant as it may indicate DLL search order hijacking or sideloading, techniques used by attackers to execute arbitrary code, maintain persistence, or escalate privileges. If confirmed malicious, this activity could allow attackers to blend in with legitimate operations, posing a severe threat to system integrity and security. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_created_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup local=t hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup local=t hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_created_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` and `Filesystem` nodes of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: This analytic may flag instances where DLLs are loaded by user mode programs for entirely legitimate and benign purposes. It is important for users to be aware that false positives are not only possible but likely, and that careful tuning of this analytic is necessary to distinguish between malicious activity and normal, everyday operations of applications. This may involve adjusting thresholds, whitelisting known good software, or incorporating additional context from other security tools and logs to reduce the rate of false positives. references: diff --git a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml index 22ae61333d..cdede1c436 100644 --- a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml +++ b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml @@ -1,17 +1,128 @@ name: Windows Known Abused DLL Loaded Suspiciously id: dd6d1f16-adc0-4e87-9c34-06189516b803 -version: 12 +version: 13 creation_date: '2024-04-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP -description: The following analytic detects when DLLs with known abuse history are loaded from an unusual location. This activity may represent an attacker performing a DLL search order or sideload hijacking technique. These techniques are used to gain persistence as well as elevate privileges on the target system. This detection relies on Sysmon EID7 and is compatible with all Officla Sysmon TA versions. +description: |- + The following analytic detects when DLLs with known abuse history are loaded from an unusual location. + This activity may represent an attacker performing a DLL search order or sideload hijacking technique. + These techniques are used to gain persistence as well as elevate privileges on the target system. data_source: - Sysmon EventID 7 -search: '`sysmon` ImageLoaded EventCode=7 NOT ImageLoaded IN ("*\\Program Files*","*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*") | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest process_exec process_guid process_hash process_id process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product loaded_file | rename Image as process | eval process_name = case(isnotnull(process),replace(process,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), loaded_file_path = case(isnotnull(loaded_file), replace(loaded_file, "(:[\w\. ]+)", "")), loaded_file = case(isnotnull(loaded_file),replace(loaded_file,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), user = case(NOT user IN ("-"), replace(user, "(.*)\\\(.+)$","\2")) | lookup hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as desc | lookup hijacklibs_loaded library AS loaded_file excludes as loaded_file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded = false | stats count min(_time) as firstTime max(_time) as lastTime by dest loaded_file loaded_file_path process process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_loaded_suspiciously_filter`' -how_to_implement: The following analytic requires Sysmon operational logs to be imported, with EID7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index. -known_false_positives: DLLs being loaded by user mode programs for legitimate reasons. +search: |- + `sysmon` + ImageLoaded + EventCode=7 + + NOT ImageLoaded IN ( + "C:\\$WINDOWS.~BT\\*", + "C:\\$WinREAgent\\*", + "C:\\Windows\\SoftwareDistribution\\*", + "C:\\Windows\\SyChpe32\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SystemTemp\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Windows\\WinSxS\\*" + ) + + NOT ( + ImageLoaded="C:\\Windows\\Temp\\*" + Image IN ( + "C:\\Windows\\WinSxS\\arm64*", + "C:\\Windows\\UUS\\arm64\\*" + ) + Image IN ( + "*\\TiWorker.exe", + "*\\wuaucltcore.exe" + ) + ) + + NOT ( + ImageLoaded="C:\\Windows\\Microsoft.NET\\*" + ImageLoaded="*\\cscui.dll" + ) + + NOT ( + ImageLoaded="C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*" + ImageLoaded="*\\version.dll" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\WindowsApps\\Microsoft.DirectXRuntime_*" + ImageLoaded="*\\d3dx9_43.dll" + ) + + NOT ImageLoaded="C:\\Windows\\ImmersiveControlPanel\\SystemSettings.dll" + + NOT ( + ImageLoaded="C:\\Program Files\\Microsoft\\Exchange Server\\*" + ImageLoaded="*\\mswb7.dll" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\Arsenal-Image-Mounter-*" + ImageLoaded IN ( + "*\\mi.dll", + "*\\miutils.dll" + ) + ) + + NOT ( + Image="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" + ImageLoaded="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" + ) + + NOT ImageLoaded="C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\*" + + NOT ( + Image IN ( + "C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*", + "C:\\Windows\\System32\\backgroundTaskHost.exe" + ) + ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs\\*" + ImageLoaded="*\\wldp.dll" + ) + + NOT ( + Image IN ( + "C:\\Program Files\\CheckPoint\\*", + "C:\\Program Files (x86)\\CheckPoint\\*" + ) + Image="*\\SmartConsole.exe" + ImageLoaded IN ( + "C:\\Program Files\\CheckPoint\\*", + "C:\\Program Files (x86)\\CheckPoint\\*" + ) + ImageLoaded="*\\PolicyManager.dll" + ) + + | lookup local=t hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as reference + | lookup local=t hijacklibs_loaded library AS loaded_file excludes AS loaded_file_path OUTPUT islibrary AS excluded + | where islibrary="TRUE" AND excluded="false" + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by dest loaded_file loaded_file_path process_exec + process_guid process_hash process_id process_name + process_path service_dll_signature_exists + service_dll_signature_verified signature + signature_id user user_id reference vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_known_abused_dll_loaded_suspiciously_filter` +how_to_implement: |- + The following analytic requires Sysmon operational logs to be ingested, with EventID 7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index. +known_false_positives: |- + False positives are expected from third party applications and other legitimate system processes located in Program Files and other similar locations. Filter as needed. references: - https://attack.mitre.org/techniques/T1574/002/ - https://hijacklibs.net/api/ @@ -27,11 +138,16 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: The module [$loaded_file$] was loaded from an unusual location. + title: The module [$loaded_file$] was loaded from an unusual location [$loaded_file_path$] on [$dest$]. Which may indicate a DLL search order or sideload hijacking technique. entity: field: dest type: system score: 50 +threat_objects: + - field: process_path + type: file_path + - field: loaded_file_path + type: file_path analytic_story: - SolarWinds WHD RCE Post Exploitation - Windows Defense Evasion Tactics diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml index de0367bd26..93cd636e66 100644 --- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml +++ b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml @@ -1,8 +1,8 @@ name: Windows LOLBAS Executed As Renamed File id: fd496996-7d9e-4894-8d40-bb85b6192dc6 -version: 10 +version: 11 creation_date: '2024-05-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -11,7 +11,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`' +search: '| tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup local=t lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: A certain amount of false positives are likely with this detection. MSI based installers often trigger for SETUPAPL.dll and vendors will often copy system exectables to a different path for application usage. references: diff --git a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml index 6f917fe249..24259e1e79 100644 --- a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml +++ b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml @@ -1,8 +1,8 @@ name: Windows LOLBAS Executed Outside Expected Path id: 326fdf44-b90c-4d2e-adca-1fd140b10536 -version: 10 +version: 11 creation_date: '2024-05-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -36,8 +36,8 @@ search: | Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` - | lookup lolbas_file_path lolbas_file_name as process_name OUTPUT description as desc - | lookup lolbas_file_path lolbas_file_name as process_name lolbas_file_path as process_path OUTPUT description as is_lolbas_path + | lookup local=t lolbas_file_path lolbas_file_name as process_name OUTPUT description as desc + | lookup local=t lolbas_file_path lolbas_file_name as process_name lolbas_file_path as process_path OUTPUT description as is_lolbas_path | search desc!="false" AND is_lolbas_path="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 5900bb891c..41f70c1871 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -1,8 +1,8 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 -version: 10 +version: 11 creation_date: '2022-01-24' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -29,7 +29,7 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile + | lookup local=t update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true | `windows_nirsoft_utilities_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_powershell_process_with_malicious_string.yml b/detections/endpoint/windows_powershell_process_with_malicious_string.yml index b9e7b2e5fa..3093678429 100644 --- a/detections/endpoint/windows_powershell_process_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_process_with_malicious_string.yml @@ -1,8 +1,8 @@ name: Windows PowerShell Process With Malicious String id: 5df35d50-e1a3-4a52-a337-92e69d9b1b8a -version: 9 +version: 10 creation_date: '2025-01-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -24,7 +24,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup malicious_powershell_strings command as process + | lookup local=t malicious_powershell_strings command as process | where isnotnull(match) | `windows_powershell_process_with_malicious_string_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml index bda2aaccd7..8556e4f676 100644 --- a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml @@ -1,15 +1,15 @@ name: Windows PowerShell Script Block With Malicious String id: 0f09cedd-10f1-4b9f-bdea-7a8b06ea575d -version: 7 +version: 8 creation_date: '2025-01-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic detects the execution of multiple offensive toolkits and commands by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` ScriptBlockText=* EventCode=4104 | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product | eval command = mvjoin(command,"\n") | lookup malicious_powershell_strings command | where isnotnull(match) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_block_with_malicious_string_filter`' +search: '`powershell` ScriptBlockText=* EventCode=4104 | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product | eval command = mvjoin(command,"\n") | lookup local=t malicious_powershell_strings command | where isnotnull(match) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_block_with_malicious_string_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: No false positives have been identified at this time. commands with overlap. references: diff --git a/detections/endpoint/windows_pua_named_pipe.yml b/detections/endpoint/windows_pua_named_pipe.yml index bbcf80eff0..68a592e092 100644 --- a/detections/endpoint/windows_pua_named_pipe.yml +++ b/detections/endpoint/windows_pua_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows PUA Named Pipe id: 95b11d20-e2c6-46a5-b526-8629f5f0860a -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,7 +38,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup pua_named_pipes pua_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t pua_named_pipes pua_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_rmm_named_pipe.yml b/detections/endpoint/windows_rmm_named_pipe.yml index 9e40b67134..fdb9a4bf18 100644 --- a/detections/endpoint/windows_rmm_named_pipe.yml +++ b/detections/endpoint/windows_rmm_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows RMM Named Pipe id: c07c7138-edf5-4a16-8b24-3842599235bf -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -37,7 +37,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup suspicious_rmm_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t suspicious_rmm_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml index 8b11854703..876973cadb 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task with Suspicious Command id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3 -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -11,7 +11,7 @@ data_source: - Windows Event Log Security 4698 - Windows Event Log Security 4700 - Windows Event Log Security 4702 -search: "`wineventlog_security` EventCode IN (4698,4700,4702)\n| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)\n| xmlkv TaskContent\n| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode\n| lookup windows_suspicious_tasks task_command as Command \n| where tool == \"shell command use\" OR tool == \"suspicious paths\"\n| eval command=TaskName, process=Command+if(isnotnull(Arguments),\" \".Arguments,\"\"), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| `windows_scheduled_task_with_suspicious_command_filter` " +search: "`wineventlog_security` EventCode IN (4698,4700,4702)\n| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)\n| xmlkv TaskContent\n| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode\n| lookup local=t windows_suspicious_tasks task_command as Command \n| where tool == \"shell command use\" OR tool == \"suspicious paths\"\n| eval command=TaskName, process=Command+if(isnotnull(Arguments),\" \".Arguments,\"\"), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| `windows_scheduled_task_with_suspicious_command_filter` " how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection. references: diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml index 872660b4e0..e4e43f175d 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task with Suspicious Name id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -16,7 +16,7 @@ search: |- | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) | xmlkv TaskContent | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode - | lookup windows_suspicious_tasks task_name as TaskName + | lookup local=t windows_suspicious_tasks task_name as TaskName | where isnotnull(tool_type) | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml index feff939ffa..99789981a9 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml @@ -1,8 +1,8 @@ name: Windows Service Created with Suspicious Service Name id: 35eb6d19-a497-400c-93c5-645562804b11 -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- | stats values(ImagePath) as process, count, min(_time) as firstTime, max(_time) as lastTime values(EventCode) as signature by Computer, ServiceName, StartType, ServiceType, UserID | eval process_name = replace(mvindex(split(process,"\\"),-1), "\"", "") | rename Computer as dest, ServiceName as object_name, ServiceType as object_type, UserID as user_id - | lookup windows_suspicious_services service_name as object_name + | lookup local=t windows_suspicious_services service_name as object_name | where isnotnull(tool_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_suspicious_c2_named_pipe.yml b/detections/endpoint/windows_suspicious_c2_named_pipe.yml index 270a890fcb..1654dfc0f8 100644 --- a/detections/endpoint/windows_suspicious_c2_named_pipe.yml +++ b/detections/endpoint/windows_suspicious_c2_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows Suspicious C2 Named Pipe id: 90599d85-dc2a-4d4c-8c59-9485c3665828 -version: 6 +version: 7 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -37,7 +37,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup suspicious_c2_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t suspicious_c2_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_suspicious_named_pipe.yml b/detections/endpoint/windows_suspicious_named_pipe.yml index c77859e3b8..38cc420561 100644 --- a/detections/endpoint/windows_suspicious_named_pipe.yml +++ b/detections/endpoint/windows_suspicious_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Named Pipe id: 3a76d52f-a007-4a65-a37d-f313c2c83f31 -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -38,7 +38,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path pipe_name user_id process_name signature signature_id vendor_product - | lookup suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description + | lookup local=t suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml index 4884e5dd26..6f5d12c6d4 100644 --- a/detections/endpoint/windows_vulnerable_driver_installed.yml +++ b/detections/endpoint/windows_vulnerable_driver_installed.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Installed id: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f -version: 11 +version: 12 creation_date: '2020-01-19' -modification_date: '2026-09-08' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -12,7 +12,7 @@ data_source: search: |- `wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" | table _time dest EventCode ImagePath ServiceName ServiceType - | lookup loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description + | lookup local=t loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description | search is_driver = TRUE | `windows_vulnerable_driver_installed_filter` how_to_implement: Ensure the Splunk is collecting XmlWinEventLog:System events and the EventCode 7045 is being ingested. diff --git a/detections/endpoint/windows_vulnerable_driver_loaded.yml b/detections/endpoint/windows_vulnerable_driver_loaded.yml index 8f9d32b550..26fcf996f6 100644 --- a/detections/endpoint/windows_vulnerable_driver_loaded.yml +++ b/detections/endpoint/windows_vulnerable_driver_loaded.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Loaded id: a2b1f1ef-221f-4187-b2a4-d4b08ec745f4 -version: 10 +version: 11 creation_date: '2022-12-31' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -15,7 +15,7 @@ search: |- BY ImageLoaded dest dvc process_hash process_path signature signature_id user_id vendor_product - | lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description + | lookup local=t loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description | search is_driver = TRUE | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/network/3cx_supply_chain_attack_network_indicators.yml b/detections/network/3cx_supply_chain_attack_network_indicators.yml index 6c02019581..946c245134 100644 --- a/detections/network/3cx_supply_chain_attack_network_indicators.yml +++ b/detections/network/3cx_supply_chain_attack_network_indicators.yml @@ -1,8 +1,8 @@ name: 3CX Supply Chain Attack Network Indicators id: 791b727c-deec-4fbe-a732-756131b3c5a1 -version: 11 +version: 12 creation_date: '2023-04-11' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -22,7 +22,7 @@ search: | | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup 3cx_ioc_domains domain as query OUTPUT Description isIOC + | lookup local=t 3cx_ioc_domains domain as query OUTPUT Description isIOC | search isIOC=true | `3cx_supply_chain_attack_network_indicators_filter` how_to_implement: To successfully implement this search you need to be ingesting information into the `Network Resolution` datamodel in the `DNS` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA''s are installed. diff --git a/detections/network/cisco_secure_firewall___binary_file_type_download.yml b/detections/network/cisco_secure_firewall___binary_file_type_download.yml index 52fa154991..1eb6a299dd 100644 --- a/detections/network/cisco_secure_firewall___binary_file_type_download.yml +++ b/detections/network/cisco_secure_firewall___binary_file_type_download.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Binary File Type Download id: 24b2c2e3-2ff7-4a23-b814-87f8a62028cd -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ data_source: search: | `cisco_secure_firewall` EventType=FileEvent FileDirection="Download" FileType IN ("ISHIELD_MSI", "BINHEX", "BINARY_DATA", "ELF", "MACHO", "JARPACK", "TORRENT", "AUTORUN", "EICAR", "LNK", "SCR", "UNIX_SCRIPT") - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri values(ClientApplication) as ClientApplication diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index 7103a3112f..68cbf8d274 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint id: c43f7b49-2dab-4e76-892e-7f971c2f20f1 -version: 7 +version: 8 creation_date: '2025-04-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense Connection Event search: | `cisco_secure_firewall` EventType=* SSL_CertFingerprint=* - | lookup sslbl_ssl_certificate_blacklist SHA1 as SSL_CertFingerprint OUTPUT Listingdate, Listingreason + | lookup local=t sslbl_ssl_certificate_blacklist SHA1 as SSL_CertFingerprint OUTPUT Listingdate, Listingreason | where isnotnull(Listingreason) | stats min(_time) as firstTime max(_time) as lastTime values(dest) as dest diff --git a/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml b/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml index 301f42145e..a6b4cb4e23 100644 --- a/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml +++ b/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - File Download Over Uncommon Port id: f26445a8-a6a2-4855-bec0-0c39e52e5b8f -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent FileDirection="Download" NOT dest_port IN (80, 443) - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(file_name) as file_name values(uri) as uri diff --git a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml index 871d3190a6..518f8f97ff 100644 --- a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml +++ b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Intrusion Events by Threat Activity id: b71e57e8-c571-4ff1-ae13-bc4384a9e891 -version: 10 +version: 11 creation_date: '2025-05-12' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -40,11 +40,11 @@ data_source: search: | `cisco_secure_firewall` EventType=IntrusionEvent | stats count AS total_alerts, dc(signature_id) AS sig_count, values(SnortRuleGroups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src) AS src BY _time dest signature_id - | lookup cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message + | lookup local=t cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message | where isnotnull(threat) | bin _time span=1d | stats count AS Total_Alerts, dc(signature_id) AS sig_count, values(signature_id) AS signature_id, values(category) AS category, values(message) AS message, values(snort_rule_groups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src) AS src BY _time dest threat - | lookup threat_snort_count threat OUTPUT description, distinct_count_snort_ids + | lookup local=t threat_snort_count threat OUTPUT description, distinct_count_snort_ids | table _time, dest, src, threat, category, message, description, signature_id, signature, snort_rule_groups, sig_count, distinct_count_snort_ids, connection_id, rule, dest_port, transport, app | where sig_count >= distinct_count_snort_ids | `cisco_secure_firewall___intrusion_events_by_threat_activity_filter` diff --git a/detections/network/cisco_secure_firewall___malware_file_downloaded.yml b/detections/network/cisco_secure_firewall___malware_file_downloaded.yml index c4280c0210..b32cf7b6ae 100644 --- a/detections/network/cisco_secure_firewall___malware_file_downloaded.yml +++ b/detections/network/cisco_secure_firewall___malware_file_downloaded.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Malware File Downloaded id: 3cc93f52-5aa6-4b7f-83b9-3430b1436813 -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download" - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri values(ClientApplication) as ClientApplication diff --git a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml index 64793a40b6..8b32c0275e 100644 --- a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml +++ b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Remote Access Software Usage Traffic id: ac54d39e-a75d-4f42-971d-006db3a0423a -version: 9 +version: 10 creation_date: '2025-05-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -26,7 +26,7 @@ search: | count by src ClientApplication action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description + | lookup local=t cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description | search category IN ("remote administration", "remote desktop control") | `remote_access_software_usage_exceptions` | `cisco_secure_firewall___remote_access_software_usage_traffic_filter` diff --git a/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml b/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml index 12bf62ba6f..972b7aeb41 100644 --- a/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml +++ b/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Repeated Malware Downloads id: aeff2bb5-3483-48d4-9be8-c8976194be1e -version: 10 +version: 11 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download" - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | bin _time span=5m | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index 6d14e36bc2..c3a4f069d9 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -1,8 +1,8 @@ name: Detect hosts connecting to dynamic domain providers id: a1e761ac-1344-4dbd-88b2-3f34c912d359 -version: 13 +version: 14 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Bhavin Patel, Splunk status: production type: TTP @@ -18,8 +18,8 @@ search: | DNS.reply_code_id DNS.src DNS.vendor_product | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` - | lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default - | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local + | lookup local=t update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default + | lookup local=t update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local | eval isDynDNS = coalesce(isDynDNS_local,isDynDNS_default) |fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True | `detect_hosts_connecting_to_dynamic_domain_providers_filter` diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index 1171d0c58f..dc927f67a6 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage DNS id: a16b797d-e309-41bd-8ba0-5067dae2e4be -version: 14 +version: 15 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -22,7 +22,7 @@ search: | | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup remote_access_software remote_domain AS query OUTPUT isutility, description as signature, + | lookup local=t remote_access_software remote_domain AS query OUTPUT isutility, description as signature, comment_reference as desc, category | eval dest = query | search isutility = True diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index 17fe2236b8..f088392075 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage Traffic id: 885ea672-07ee-475a-879e-60d28aa5dd42 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -30,7 +30,7 @@ search: | | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter` diff --git a/detections/network/http_c2_framework_user_agent.yml b/detections/network/http_c2_framework_user_agent.yml index a442d265c5..db8c77cf01 100644 --- a/detections/network/http_c2_framework_user_agent.yml +++ b/detections/network/http_c2_framework_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP C2 Framework User Agent id: 229dc225-6abe-4d28-89fd-edf874086162 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Ravent Tait, Splunk status: production type: TTP @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup suspicious_c2_user_agents c2_user_agent AS http_user_agent OUTPUT tool, description + | lookup local=t suspicious_c2_user_agents c2_user_agent AS http_user_agent OUTPUT tool, description | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/http_malware_user_agent.yml b/detections/network/http_malware_user_agent.yml index df79a6ba05..5490fc528f 100644 --- a/detections/network/http_malware_user_agent.yml +++ b/detections/network/http_malware_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP Malware User Agent id: 8c4866e4-f488-4253-8537-7dc4f954c292 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup malware_user_agents malware_user_agent AS http_user_agent OUTPUT malware + | lookup local=t malware_user_agents malware_user_agent AS http_user_agent OUTPUT malware | where isnotnull(malware) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY malware url http_user_agent diff --git a/detections/network/http_pua_user_agent.yml b/detections/network/http_pua_user_agent.yml index a20df5452a..b05dd3386e 100644 --- a/detections/network/http_pua_user_agent.yml +++ b/detections/network/http_pua_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP PUA User Agent id: 21af5447-734f-4549-956b-7a255cb2b032 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup pua_user_agents pua_user_agent AS http_user_agent OUTPUT tool + | lookup local=t pua_user_agents pua_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/http_rmm_user_agent.yml b/detections/network/http_rmm_user_agent.yml index dde34ab9e5..1ad50d30cb 100644 --- a/detections/network/http_rmm_user_agent.yml +++ b/detections/network/http_rmm_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP RMM User Agent id: 61884b02-0dcf-44c5-9094-db33bac09fa6 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup rmm_user_agents rmm_user_agent AS http_user_agent OUTPUT tool + | lookup local=t rmm_user_agents rmm_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index 2235c3e236..d305d4f139 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -1,8 +1,8 @@ name: Prohibited Network Traffic Allowed id: ce5a0962-849f-4720-a678-753fe6674479 -version: 15 +version: 16 creation_date: '2020-04-29' -modification_date: '2026-09-08' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -36,7 +36,7 @@ search: |- All_Traffic.dest_port All_Traffic.dvc All_Traffic.transport All_Traffic.vendor_product - | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note + | lookup local=t update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 1a8700de2a..228dd2e6a2 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -35,7 +35,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("Web")` - | lookup remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference + | lookup local=t remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` diff --git a/detections/web/http_scripting_tool_user_agent.yml b/detections/web/http_scripting_tool_user_agent.yml index 629822d8dd..2a3328ef83 100644 --- a/detections/web/http_scripting_tool_user_agent.yml +++ b/detections/web/http_scripting_tool_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP Scripting Tool User Agent id: 04430b4e-5ca8-4e88-98b5-d6bcf54f8393 -version: 6 +version: 7 creation_date: '2025-10-21' -modification_date: '2026-06-15' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `security_content_ctime(lastTime)` | `drop_dm_object_name(Web)` | eval http_user_agent = lower(http_user_agent) - | lookup scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool + | lookup local=t scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen diff --git a/lookups/csv/hijacklibs_loaded.csv b/lookups/csv/hijacklibs_loaded.csv index d3523b22ad..3a14253534 100644 --- a/lookups/csv/hijacklibs_loaded.csv +++ b/lookups/csv/hijacklibs_loaded.csv @@ -1,887 +1,887 @@ islibrary,library,excludes,ttp,comment -TRUE,aclui.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,aclui.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,acrodistdll.dll,*\Program Files\Adobe\Acrobat *,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf +TRUE,aclui.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,aclui.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,acrodistdll.dll,*:\Program Files\Adobe\Acrobat *,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf TRUE,acrodistdll.dll,*\Acrobat\acrodistdll*,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf -TRUE,activeds.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,activeds.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,adsldpc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,adsldpc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,aepic.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,aepic.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,apphelp.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,apphelp.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,applicationframe.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,applicationframe.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,appvpolicy.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,appwiz.cpl,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ -TRUE,appwiz.cpl,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ -TRUE,appxalluserstore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxalluserstore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxdeploymentclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxdeploymentclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,archiveint.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,archiveint.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ashldres.dll,*\Program Files\McAfee.com\VSO*,T1574.002,https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-rotten-tomato-campaign.pdf -TRUE,atl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,atl.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,atltracetoolui.dll,*\Program Files\Microsoft Visual Studio 11.0\Common7\Tools*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,audioses.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,audioses.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,auditpolcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,auditpolcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authfwcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authfwcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authz.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authz.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,avrt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,avrt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,activeds.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,activeds.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,adsldpc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,adsldpc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,aepic.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,aepic.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,apphelp.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,apphelp.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,applicationframe.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,applicationframe.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,appvpolicy.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,appwiz.cpl,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ +TRUE,appwiz.cpl,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ +TRUE,appxalluserstore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxalluserstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxdeploymentclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxdeploymentclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,archiveint.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,archiveint.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ashldres.dll,*:\Program Files\McAfee.com\VSO*,T1574.002,https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-rotten-tomato-campaign.pdf +TRUE,atl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,atl.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,atltracetoolui.dll,*:\Program Files\Microsoft Visual Studio 11.0\Common7\Tools*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,audioses.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,audioses.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,auditpolcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,auditpolcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authfwcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authfwcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authz.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authz.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,avrt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,avrt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,basicnetutils.dll,*\Appdata\local\Temp\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,basicnetutils.dll,*\Program Files\BAIDU\BAIDUPINYIN\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,batmeter.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,batmeter.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,bcd.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcd.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47langs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47langs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47mrm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47mrm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcrypt.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,bcrypt.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,bderepair.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bootmenuux.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bootux.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cabinet.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cabinet.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cabview.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cabview.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,certcli.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,certcli.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,certenroll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,certenroll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cfgmgr32.dll,*\Windows\System32\*,T1574.002, -TRUE,cfgmgr32.dll,*\Windows\SysWOW64\*,T1574.002, +TRUE,basicnetutils.dll,*:\Program Files\BAIDU\BAIDUPINYIN\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,batmeter.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,batmeter.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,bcd.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcd.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47langs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47langs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47mrm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47mrm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcrypt.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,bcrypt.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,bderepair.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bootmenuux.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bootux.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cabinet.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cabinet.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cabview.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cabview.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,certcli.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,certcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,certenroll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,certenroll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cfgmgr32.dll,*:\Windows\System32\*,T1574.002, +TRUE,cfgmgr32.dll,*:\Windows\SysWOW64\*,T1574.002, TRUE,chrome_frame_helper.dll,*\Appdata\local\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,chrome_frame_helper.dll,*\Program Files\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,chrome_frame_helper.dll,*:\Program Files\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ TRUE,ciscosparklauncher.dll,*\Appdata\local\CiscoSparkLauncher*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ TRUE,ciscosparklauncher.dll,*\AppData\Local\Programs\Cisco Spark\*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ -TRUE,classicexplorer32.dll,*\Program Files\Classic Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets -TRUE,classicexplorer32.dll,*\Program Files\Open-Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets -TRUE,cldapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cldapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clipc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clipc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clusapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clusapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmpbk32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmpbk32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cmutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coloradapterclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coloradapterclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,colorui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,colorui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,comdlg32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,comdlg32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,commfunc.dll,*\Program Files\Lenovo\Communications Utility*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,configmanager2.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,connect.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,connect.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,coredplus.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coremessaging.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coremessaging.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coreuicomponents.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coreuicomponents.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,credui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,credui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptbase.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptdll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptdll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptsp.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cryptsp.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cryptui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptxml.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptxml.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscobj.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscobj.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscui.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscui.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,d2d1.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d2d1.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10warp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10warp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d11.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d11.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d12.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d12.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d9.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d9.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\redist\d3d\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\redist\d3d\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\wireshark*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\microsoft\edge\application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\Google\Chrome\Application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,classicexplorer32.dll,*:\Program Files\Classic Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets +TRUE,classicexplorer32.dll,*:\Program Files\Open-Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets +TRUE,cldapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cldapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clipc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clipc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clusapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clusapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmpbk32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmpbk32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cmutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coloradapterclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coloradapterclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,colorui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,colorui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,comdlg32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,comdlg32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,commfunc.dll,*:\Program Files\Lenovo\Communications Utility*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,configmanager2.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,connect.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,connect.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,coredplus.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coremessaging.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coremessaging.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coreuicomponents.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coreuicomponents.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,credui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,credui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptbase.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptdll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptdll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptsp.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cryptsp.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cryptui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptxml.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptxml.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscobj.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscobj.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscui.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscui.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,d2d1.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d2d1.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10warp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10warp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d11.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d11.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d12.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d12.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d9.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d9.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\redist\d3d\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\redist\d3d\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\wireshark*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\microsoft\edge\application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\Google\Chrome\Application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,d3dcompiler_47.dll,*\Appdata\local\microsoft\teams\stage*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,d3dcompiler_47.dll,*\Microsoft\Teams\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dx9_43.dll,*\Windows\System32\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,d3dx9_43.dll,*\Windows\SysWOW64\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,dataexchange.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dataexchange.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,davclnt.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,davclnt.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgmodel.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dbgmodel.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dbgmodel.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dcntel.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dcomp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dcomp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,defragproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,defragproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,desktopshellext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,desktopshellext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,deviceassociation.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,deviceassociation.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicecredential.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicecredential.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicepairing.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,devicepairing.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,devobj.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devobj.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devrtl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devrtl.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcmonitor.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcmonitor.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc6.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc6.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,directmanipulation.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,directmanipulation.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dismapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dismapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dismcore.dll,*\Windows\System32\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ -TRUE,dismcore.dll,*\Windows\SysWOW64\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ -TRUE,dmcfgutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcfgutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcmnutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcmnutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcommandlineutils.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dmcommandlineutils.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dmenrollengine.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmenrollengine.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmenterprisediagnostics.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmiso8601utils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmiso8601utils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmoleaututils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmoleaututils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmprocessxmlfiltered.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmprocessxmlfiltered.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmpushproxy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmpushproxy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmxmlhelputils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmxmlhelputils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dnsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dnsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3api.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3api.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3cfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3cfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dpx.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dpx.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,drprov.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,drprov.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,drvstore.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,drvstore.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsparse.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsparse.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsprop.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsprop.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsreg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsreg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsrole.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsrole.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dui70.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dui70.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,duser.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,duser.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dusmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dusmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwrite.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwrite.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxcore.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dxcore.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dxgi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxgi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxva2.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxva2.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dynamoapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappprxy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappprxy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,edgeiso.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,edgeiso.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,edputil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,edputil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsadu.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsadu.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,esent.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,esent.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,execmodelproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,execmodelproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,explorerframe.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,explorerframe.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,facesdk.dll,*\Program Files\luxand\facesdk\bin\win64*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,fastprox.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fastprox.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,faultrep.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,faultrep.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fddevquery.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fddevquery.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,feclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,feclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fhcfg.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fhcfg.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fhsvcctl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,firewallapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,firewallapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,flightsettings.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,flightsettings.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fltlib.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fltlib.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,formdll.dll,*\Program Files\Common Files\Microsoft Shared\NoteSync Forms*,T1574.002,https://any.run/report/d9c7f6d4ec08d961c20dac1b6422b3fbec5c6a8d9dc67d1f604835b36c5f224e/ae068531-92db-497d-b0cb-c0b1af5476f1 -TRUE,framedynos.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,framedynos.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fveapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fveapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fveskybackup.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fvewiz.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fwbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwbase.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpolicyiomgr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpolicyiomgr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpuclnt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpuclnt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsst.dll,*\Windows\System32\*,T1574.001,https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/ -TRUE,fxstiff.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxstiff.dll,*\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,getuname.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,getuname.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,gflagsui.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Tools*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Workstation*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Player*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,gpapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,gpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,hha.dll,*\Windows\System32\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hha.dll,*\Windows\SysWOW64\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hha.dll,*\Program Files\HTML Help Workshop*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hid.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hid.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hnetmon.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hnetmon.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hpcustpartui.dll,*\Program Files\HP*,T1574.002,https://www.trellix.com/en-us/about/newsroom/stories/research/operation-harvest-a-deep-dive-into-a-long-term-campaign.html -TRUE,hpqhvsei.dll,*\Program Files\HP*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,httpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,httpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,icmp.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,icmp.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,idstore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,idstore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ieadvpack.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ieadvpack.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iedkcs32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iedkcs32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iernonce.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ -TRUE,iernonce.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ -TRUE,iertutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iertutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifmon.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifmon.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifsutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,ifsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,inproclogger.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iphlpapi.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iphlpapi.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iri.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iri.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsidsc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsidsc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsiexe.dll,*\Windows\System32\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC -TRUE,iscsiexe.dll,*\Windows\SysWOW64\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC -TRUE,iscsium.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsium.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,isv.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,isv.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,iumbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iumsdk.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,joinutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,joinutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,kdstub.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ksuser.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ksuser.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ktmw32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ktmw32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ldvpocx.ocx,*\Program Files\Symantec_Client_Security\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox -TRUE,ldvpocx.ocx,*\Program Files\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox +TRUE,d3dx9_43.dll,*:\Windows\System32\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,d3dx9_43.dll,*:\Windows\SysWOW64\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,dataexchange.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dataexchange.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,davclnt.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,davclnt.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgmodel.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dbgmodel.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dbgmodel.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dcntel.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dcomp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dcomp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,defragproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,defragproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,desktopshellext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,desktopshellext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,deviceassociation.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,deviceassociation.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicecredential.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicecredential.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicepairing.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,devicepairing.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,devobj.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devobj.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devrtl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devrtl.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcmonitor.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcmonitor.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc6.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc6.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,directmanipulation.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,directmanipulation.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dismapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dismapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dismcore.dll,*:\Windows\System32\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ +TRUE,dismcore.dll,*:\Windows\SysWOW64\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ +TRUE,dmcfgutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcfgutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcmnutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcmnutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcommandlineutils.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dmcommandlineutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dmenrollengine.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmenrollengine.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmenterprisediagnostics.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmiso8601utils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmiso8601utils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmoleaututils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmoleaututils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmprocessxmlfiltered.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmprocessxmlfiltered.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmpushproxy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmpushproxy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmxmlhelputils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmxmlhelputils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dnsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dnsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3api.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3api.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3cfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3cfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dpx.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dpx.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,drprov.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,drprov.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,drvstore.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,drvstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsparse.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsparse.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsprop.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsprop.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsreg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsreg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsrole.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsrole.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dui70.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dui70.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,duser.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,duser.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dusmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dusmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwrite.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwrite.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxcore.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dxcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dxgi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxgi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxva2.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxva2.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dynamoapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappprxy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappprxy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,edgeiso.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,edgeiso.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,edputil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,edputil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsadu.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsadu.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,esent.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,esent.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,execmodelproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,execmodelproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,explorerframe.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,explorerframe.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,facesdk.dll,*:\Program Files\luxand\facesdk\bin\win64*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,fastprox.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fastprox.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,faultrep.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,faultrep.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fddevquery.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fddevquery.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,feclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,feclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fhcfg.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fhcfg.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fhsvcctl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,firewallapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,firewallapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,flightsettings.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,flightsettings.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fltlib.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fltlib.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,formdll.dll,*:\Program Files\Common Files\Microsoft Shared\NoteSync Forms*,T1574.002,https://any.run/report/d9c7f6d4ec08d961c20dac1b6422b3fbec5c6a8d9dc67d1f604835b36c5f224e/ae068531-92db-497d-b0cb-c0b1af5476f1 +TRUE,framedynos.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,framedynos.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fveapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fveapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fveskybackup.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fvewiz.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fwbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwbase.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpolicyiomgr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpolicyiomgr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpuclnt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpuclnt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsst.dll,*:\Windows\System32\*,T1574.001,https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/ +TRUE,fxstiff.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxstiff.dll,*:\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,getuname.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,getuname.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,gflagsui.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Tools*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Workstation*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Player*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,gpapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,gpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,hha.dll,*:\Windows\System32\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hha.dll,*:\Windows\SysWOW64\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hha.dll,*:\Program Files\HTML Help Workshop*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hid.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hid.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hnetmon.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hnetmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hpcustpartui.dll,*:\Program Files\HP*,T1574.002,https://www.trellix.com/en-us/about/newsroom/stories/research/operation-harvest-a-deep-dive-into-a-long-term-campaign.html +TRUE,hpqhvsei.dll,*:\Program Files\HP*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,httpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,httpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,icmp.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,icmp.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,idstore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,idstore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ieadvpack.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ieadvpack.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iedkcs32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iedkcs32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iernonce.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ +TRUE,iernonce.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ +TRUE,iertutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iertutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifmon.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifsutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,ifsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,inproclogger.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iphlpapi.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iphlpapi.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iri.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iri.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsidsc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsidsc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsiexe.dll,*:\Windows\System32\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC +TRUE,iscsiexe.dll,*:\Windows\SysWOW64\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC +TRUE,iscsium.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsium.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,isv.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,isv.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,iumbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iumsdk.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,joinutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,joinutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,kdstub.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ksuser.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ksuser.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ktmw32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ktmw32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ldvpocx.ocx,*:\Program Files\Symantec_Client_Security\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox +TRUE,ldvpocx.ocx,*:\Program Files\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox TRUE,libcares-2.dll,*\git\mingw64\*,T1574.002,https://www.trellix.com/en-au/blogs/research/hiding-in-plain-sight-multi-actor-ahost-exe-attacks/ -TRUE,libvlc.dll,*\Program Files\VideoLAN\VLC*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ -TRUE,licensemanagerapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,licensemanagerapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,licensingdiagspp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,licensingdiagspp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,linkinfo.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,linkinfo.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn\x86*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn\x64*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,loadperf.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,loadperf.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,lockdown.dll,*\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://twitter.com/thepacketrat/status/1520878930449817600 -TRUE,lockhostingframework.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,log.dll,*\Program Files\Bitdefender Antivirus Free*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,logoncli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,logoncli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,logoncontroller.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,logoncontroller.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lpksetupproxyserv.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lpksetupproxyserv.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lrwizdll.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,magnification.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,magnification.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,maintenanceui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mapistub.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mapistub.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mbaexmlparser.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mdmdiagnostics.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfc42u.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mfc42u.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mfcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfplat.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfplat.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,midimap.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,midimap.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mintdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,miutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,miutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mlang.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mlang.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mmdevapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mmdevapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mobilenetworking.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mobilenetworking.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mozglue.dll,*\Program Files\SeaMonkey*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mozglue.dll,*\Program Files\Mozilla Firefox*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mozglue.dll,*\Program Files\Mozilla Thunderbird*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,libvlc.dll,*:\Program Files\VideoLAN\VLC*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ +TRUE,licensemanagerapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,licensemanagerapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,licensingdiagspp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,licensingdiagspp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,linkinfo.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,linkinfo.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn\x86*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn\x64*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,loadperf.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,loadperf.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,lockdown.dll,*:\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://twitter.com/thepacketrat/status/1520878930449817600 +TRUE,lockhostingframework.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,log.dll,*:\Program Files\Bitdefender Antivirus Free*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,logoncli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,logoncli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,logoncontroller.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,logoncontroller.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lpksetupproxyserv.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lpksetupproxyserv.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lrwizdll.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,magnification.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,magnification.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,maintenanceui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mapistub.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mapistub.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mbaexmlparser.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mdmdiagnostics.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfc42u.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mfc42u.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mfcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfplat.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfplat.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,midimap.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,midimap.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mintdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,miutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,miutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mlang.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mlang.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mmdevapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mmdevapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mobilenetworking.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mobilenetworking.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mozglue.dll,*:\Program Files\SeaMonkey*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mozglue.dll,*:\Program Files\Mozilla Firefox*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mozglue.dll,*:\Program Files\Mozilla Thunderbird*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,mozglue.dll,*\AppData\Local\Mozilla Firefox\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mpclient.dll,*\Program Files\Windows Defender*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ +TRUE,mpclient.dll,*:\Program Files\Windows Defender*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ TRUE,mpclient.dll,*\ProgramData\Microsoft\Windows Defender\Platform\*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ -TRUE,mpr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mpr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mprapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mprapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mpsvc.dll,*\Program Files\Windows Defender\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ +TRUE,mpr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mpr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mprapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mprapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mpsvc.dll,*:\Program Files\Windows Defender\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ TRUE,mpsvc.dll,*\ProgramData\Microsoft\Windows Defender\Platform\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ -TRUE,mrmcorer.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mrmcorer.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msacm32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msacm32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscms.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscms.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscoree.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscoree.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscorsvc.dll,*\Windows\Microsoft.NET\Framework\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,mscorsvc.dll,*\Windows\Microsoft.NET\Framework64\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,msctf.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msctf.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msctfmonitor.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msctfmonitor.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdrm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdrm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdtctm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msftedit.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,msftedit.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,msi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msiso.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msiso.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msutb.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msutb.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msvcp110_win.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msvcp110_win.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msvcr100.dll,*\Windows\System32\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,msvcr100.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mswb7.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswb7.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswsock.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswsock.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msxml3.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msxml3.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mtxclu.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mtxclu.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,napinsp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,napinsp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ncrypt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ncrypt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ndfapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ndfapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netapi32.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netid.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netid.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netiohlp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netiohlp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netjoin.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netjoin.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netplwiz.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netplwiz.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netprofm.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netprofm.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netprovfw.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netprovfw.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netsetupapi.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netsetupapi.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netshell.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netshell.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nettrace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,networkexplorer.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,networkexplorer.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,newdev.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,newdev.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ninput.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ninput.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlaapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlaapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlansp_c.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nlansp_c.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,npmproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,npmproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nshhttp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshhttp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshipsec.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshipsec.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshwfp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshwfp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntdsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntdsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntlanman.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntlanman.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntlmshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntlmshared.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntmarta.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntmarta.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntshrui.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntshrui.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nvsmartmax.dll,*\Program Files\NVIDIA Corporation\Display*,T1574.002,https://www.cybereason.com/blog/research/deadringer-exposing-chinese-threat-actors-targeting-major-telcos -TRUE,oleacc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,oleacc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,omadmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,omadmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,onex.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,onex.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,opcservices.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,opcservices.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mrmcorer.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mrmcorer.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msacm32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msacm32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscms.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscms.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscoree.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscoree.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscorsvc.dll,*:\Windows\Microsoft.NET\Framework\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,mscorsvc.dll,*:\Windows\Microsoft.NET\Framework64\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,msctf.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msctf.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msctfmonitor.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msctfmonitor.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdrm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdrm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdtctm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msftedit.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,msftedit.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,msi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msiso.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msiso.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msutb.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msutb.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msvcp110_win.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msvcp110_win.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msvcr100.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,msvcr100.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mswb7.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswb7.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswsock.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswsock.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msxml3.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msxml3.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mtxclu.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mtxclu.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,napinsp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,napinsp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ncrypt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ncrypt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ndfapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ndfapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netapi32.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netid.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netid.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netiohlp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netiohlp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netjoin.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netjoin.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netplwiz.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netplwiz.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netprofm.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netprofm.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netprovfw.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netprovfw.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netsetupapi.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netsetupapi.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netshell.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netshell.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nettrace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,networkexplorer.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,networkexplorer.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,newdev.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,newdev.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ninput.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ninput.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlaapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlaapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlansp_c.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nlansp_c.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,npmproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,npmproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nshhttp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshhttp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshipsec.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshipsec.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshwfp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshwfp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntdsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntdsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntlanman.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntlanman.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntlmshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntlmshared.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntmarta.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntmarta.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntshrui.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntshrui.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nvsmartmax.dll,*:\Program Files\NVIDIA Corporation\Display*,T1574.002,https://www.cybereason.com/blog/research/deadringer-exposing-chinese-threat-actors-targeting-major-telcos +TRUE,oleacc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,oleacc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,omadmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,omadmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,onex.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,onex.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,opcservices.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,opcservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ TRUE,opera_elf.dll,*\Appdata\local\programs\opera\*,T1574.002,https://twitter.com/ShitSecure/status/1566127363389329412 -TRUE,osbaseln.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osbaseln.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osksupport.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osuninst.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osuninst.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,outllib.dll,*\Program Files\Microsoft Office\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 -TRUE,outllib.dll,*\Program Files\Microsoft Office\Root\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 -TRUE,p2p.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2p.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2pnetsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2pnetsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p9np.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,p9np.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pcaui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pcaui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pdh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,peerdistsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,peerdistsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pkeyhelper.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,pla.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pla.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,playsndsrv.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,playsndsrv.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,pnrpnsp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pnrpnsp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,policymanager.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,policymanager.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,polstore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,polstore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,powrprof.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,powrprof.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,printui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,printui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,prntvpt.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,prntvpt.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,profapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,profapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,propsys.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,propsys.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,proximitycommon.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,proximitycommon.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,proximityservicepal.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,prvdmofcomp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,prvdmofcomp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,puiapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,puiapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,python39.dll,*\Program Files\Python39*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,osbaseln.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osbaseln.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osksupport.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osuninst.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osuninst.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,outllib.dll,*:\Program Files\Microsoft Office\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 +TRUE,outllib.dll,*:\Program Files\Microsoft Office\Root\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 +TRUE,p2p.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2p.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2pnetsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2pnetsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p9np.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,p9np.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pcaui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pcaui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pdh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,peerdistsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,peerdistsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pkeyhelper.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,pla.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pla.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,playsndsrv.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,playsndsrv.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,pnrpnsp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pnrpnsp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,policymanager.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,policymanager.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,polstore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,polstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,powrprof.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,powrprof.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,printui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,printui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,prntvpt.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,prntvpt.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,profapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,profapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,propsys.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,propsys.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,proximitycommon.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,proximitycommon.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,proximityservicepal.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,prvdmofcomp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,prvdmofcomp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,puiapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,puiapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,python39.dll,*:\Program Files\Python39*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,python39.dll,*\Appdata\local\Temp\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,python39.dll,*\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\VC\SecurityIssueAnalysis\python*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,python39.dll,*:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\VC\SecurityIssueAnalysis\python*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,python39.dll,*\Users\anaconda3*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,qrt.dll,*\Program Files\F-Secure\Anti-Virus*,T1574.002,https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ -TRUE,radcui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,radcui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasdlg.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,rasdlg.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,rasgcw.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rasgcw.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rasman.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasman.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasmontr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasmontr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rastls.dll,*\Program Files\Symantec\Network Connected Devices Auto Setup*,T1574.002,https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf -TRUE,rcdll.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,reagent.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,reagent.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,regapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,regapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,reseteng.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resetengine.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rjvplatform.dll,*\Windows\System32\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 -TRUE,rjvplatform.dll,*\Windows\SysWOW64\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 -TRUE,rmclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rmclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rpcnsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rpcnsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rtutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtworkq.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtworkq.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,qrt.dll,*:\Program Files\F-Secure\Anti-Virus*,T1574.002,https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ +TRUE,radcui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,radcui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasdlg.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,rasdlg.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,rasgcw.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rasgcw.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rasman.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasman.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasmontr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasmontr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rastls.dll,*:\Program Files\Symantec\Network Connected Devices Auto Setup*,T1574.002,https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf +TRUE,rcdll.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,reagent.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,reagent.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,regapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,regapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,reseteng.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resetengine.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rjvplatform.dll,*:\Windows\System32\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 +TRUE,rjvplatform.dll,*:\Windows\SysWOW64\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 +TRUE,rmclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rmclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rpcnsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rpcnsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rtutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtworkq.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtworkq.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,rzlog4cpp_logger.dll,*\Appdata\local\razer\InGameEngine\cache\RzFpsApplet*,T1574.002,https://www.mandiant.com/resources/blog/china-nexus-espionage-southeast-asia -TRUE,safestore32.dll,*\Program Files\Sophos\Sophos Anti-Virus*,T1574.002,https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf -TRUE,samcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samlib.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samlib.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sapi_onecore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sapi_onecore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sas.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sas.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scansetting.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scansetting.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scecli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scecli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,schedcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,schedcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,secur32.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,secur32.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,security.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,security.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,sensapi.dll,*\Windows\System32\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 -TRUE,sensapi.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 -TRUE,shell32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,shell32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,shfolder.dll,*\Windows\System32\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 -TRUE,shfolder.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 -TRUE,siteadv.dll,*\Program Files\SiteAdvisor\*,T1574.002,https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf -TRUE,slc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,slc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,smadhook32c.dll,*\Program Files\Smadav*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,snmpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,snmpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spectrumsyncclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppcext.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,sppcext.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srmtrace.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srmtrace.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srvcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srvcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ssp.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp_isv.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp_isv.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sspicli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sspicli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ssshim.dll,*\Windows\System32\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 -TRUE,ssshim.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 -TRUE,staterepository.core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,staterepository.core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,structuredquery.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,structuredquery.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sxshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sxshared.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,symsrv.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,systemsettingsthresholdadminflowui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tbs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tbs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tdh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,textshaping.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,textshaping.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,timesync.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tmdbglog.dll,*\Program Files\Trend Micro\Titanium*,T1574.002,https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ -TRUE,tosbtkbd.dll,*\Program Files\Toshiba\Bluetooth Toshiba Stack*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,tpmcoreprovisioning.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,tpmcoreprovisioning.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,tquery.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tquery.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tsworkspace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tsworkspace.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ttdrecord.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ttdrecord.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,twext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinui.appcore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinui.appcore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uianimation.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uianimation.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uiautomationcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uiautomationcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uireng.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uireng.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uiribbon.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uiribbon.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,umpdc.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,umpdc.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,unattend.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,safestore32.dll,*:\Program Files\Sophos\Sophos Anti-Virus*,T1574.002,https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf +TRUE,samcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samlib.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samlib.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sapi_onecore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sapi_onecore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sas.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sas.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scansetting.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scansetting.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scecli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scecli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,schedcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,schedcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,secur32.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,secur32.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,security.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,security.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,sensapi.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 +TRUE,sensapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 +TRUE,shell32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,shell32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,shfolder.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 +TRUE,shfolder.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 +TRUE,siteadv.dll,*:\Program Files\SiteAdvisor\*,T1574.002,https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf +TRUE,slc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,slc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,smadhook32c.dll,*:\Program Files\Smadav*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,snmpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,snmpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spectrumsyncclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppcext.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,sppcext.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srmtrace.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srmtrace.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srvcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srvcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ssp.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp_isv.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp_isv.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sspicli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sspicli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ssshim.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 +TRUE,ssshim.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 +TRUE,staterepository.core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,staterepository.core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,structuredquery.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,structuredquery.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sxshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sxshared.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,symsrv.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,systemsettingsthresholdadminflowui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tbs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tbs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tdh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,textshaping.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,textshaping.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,timesync.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tmdbglog.dll,*:\Program Files\Trend Micro\Titanium*,T1574.002,https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ +TRUE,tosbtkbd.dll,*:\Program Files\Toshiba\Bluetooth Toshiba Stack*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,tpmcoreprovisioning.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,tpmcoreprovisioning.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,tquery.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tquery.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tsworkspace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tsworkspace.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ttdrecord.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ttdrecord.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,twext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinui.appcore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinui.appcore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uianimation.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uianimation.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uiautomationcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uiautomationcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uireng.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uireng.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uiribbon.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uiribbon.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,umpdc.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,umpdc.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,unattend.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ TRUE,unityplayer.dll,*\Appdata\local\Temp\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,updatepolicy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,updatepolicy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,upshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,urlmon.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,urlmon.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,userenv.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,userenv.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,utildll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,utildll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxinit.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxinit.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxtheme.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxtheme.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vaultcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vaultcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vdsutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vdsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vender.dll,*\Program Files\ASUS\GPU TweakII*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,vender.dll,*\Program Files\ASUS\VGA COM\*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,version.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,version.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x64*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,virtdisk.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,virtdisk.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,updatepolicy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,updatepolicy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,upshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,urlmon.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,urlmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,userenv.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,userenv.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,utildll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,utildll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxinit.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxinit.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxtheme.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxtheme.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vaultcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vaultcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vdsutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vdsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vender.dll,*:\Program Files\ASUS\GPU TweakII*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,vender.dll,*:\Program Files\ASUS\VGA COM\*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,version.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,version.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x64*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,virtdisk.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,virtdisk.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,vivaldi_elf.dll,*\Appdata\local\Vivaldi\Application*,T1574.002,https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/ TRUE,vivaldi_elf.dll,*\Appdata\local\Vivaldi\Application\*,T1574.002,https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/ -TRUE,vntfxf32.dll,*\Program Files\Venta\VentaFax & Voice*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,vsodscpl.dll,*\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://eiploader.wordpress.com/2011/03/28/digitally-signed-malware-without-stealing-certificates/ -TRUE,vssapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vssapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vsstrace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vsstrace.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wbemprox.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemprox.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemsvc.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemsvc.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wcmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wcmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wcnnetsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdscore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdscore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,webservices.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,webservices.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wecapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wecapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wer.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wer.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wevtapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wevtapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,whhelper.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,whhelper.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wimgapi.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,wimgapi.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,wimgapi.dll,*\Program Files\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\arm64\DISM*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,winbio.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winbio.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winbrand.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winbrand.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windows.storage.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.search.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.search.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.ui.immersive.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,windows.ui.immersive.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,windowscodecs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowscodecs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowscodecsext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowscodecsext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowsperformancerecordercontrol.dll,*\Program Files\windows kits\10\windows performance toolkit*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecordercontrol.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecordercontrol.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecorderui.dll,*\Program Files\Windows Kits\10\Windows Performance Toolkit*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,windowsudk.shellcommon.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowsudk.shellcommon.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winhttp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winhttp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wininet.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wininet.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winipsec.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winipsec.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmde.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winnsi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winnsi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winrnr.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winrnr.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winscard.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winscard.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winsqlite3.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsqlite3.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsta.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsta.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsync.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winsync.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winutils.dll,*\Program Files\Palo Alto Networks\Traps*,T1574.002,https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/ -TRUE,wkscli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wkscli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlanapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlanapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlancfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlancfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wldp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wldp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlidprov.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wlidprov.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiclnt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmiclnt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmidcom.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmidcom.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiutils.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiutils.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmpdui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmsgapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmsgapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wofutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wofutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wpdshext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wpdshext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wsc.dll,*\Program Files\AVAST Software\Avast*,T1574.001,https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2 -TRUE,wscapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wscapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wsdapi.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,wsdapi.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,wshbth.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wshbth.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wshelper.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wshelper.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wsmsvc.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wsmsvc.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wtsapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wtsapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwancfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwancfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xmllite.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xmllite.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xolehlp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xolehlp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xpsservices.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,xpsservices.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,xwizards.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwizards.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwtpw32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwtpw32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,vntfxf32.dll,*:\Program Files\Venta\VentaFax & Voice*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,vsodscpl.dll,*:\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://eiploader.wordpress.com/2011/03/28/digitally-signed-malware-without-stealing-certificates/ +TRUE,vssapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vssapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vsstrace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vsstrace.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wbemprox.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemprox.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemsvc.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemsvc.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wcmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wcmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wcnnetsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdscore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdscore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,webservices.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,webservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wecapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wecapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wer.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wer.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wevtapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wevtapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,whhelper.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,whhelper.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wimgapi.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,wimgapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,wimgapi.dll,*:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\arm64\DISM*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,winbio.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winbio.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winbrand.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winbrand.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windows.storage.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.search.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.search.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.ui.immersive.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,windows.ui.immersive.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,windowscodecs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowscodecs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowscodecsext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowscodecsext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowsperformancerecordercontrol.dll,*:\Program Files\windows kits\10\windows performance toolkit*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecordercontrol.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecordercontrol.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecorderui.dll,*:\Program Files\Windows Kits\10\Windows Performance Toolkit*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,windowsudk.shellcommon.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowsudk.shellcommon.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winhttp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winhttp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wininet.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wininet.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winipsec.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winipsec.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmde.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winnsi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winnsi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winrnr.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winrnr.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winscard.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winscard.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winsqlite3.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsqlite3.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsta.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsta.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsync.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winsync.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winutils.dll,*:\Program Files\Palo Alto Networks\Traps*,T1574.002,https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/ +TRUE,wkscli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wkscli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlanapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlanapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlancfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlancfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wldp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wldp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlidprov.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wlidprov.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiclnt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmiclnt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmidcom.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmidcom.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiutils.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiutils.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmpdui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmsgapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmsgapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wofutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wofutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wpdshext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wpdshext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wsc.dll,*:\Program Files\AVAST Software\Avast*,T1574.001,https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2 +TRUE,wscapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wscapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wsdapi.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,wsdapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,wshbth.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wshbth.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wshelper.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wshelper.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wsmsvc.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wsmsvc.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wtsapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wtsapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwancfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwancfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xmllite.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xmllite.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xolehlp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xolehlp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xpsservices.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,xpsservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,xwizards.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwizards.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwtpw32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwtpw32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables diff --git a/macros/base64decode.yml b/macros/base64decode.yml index 99fe5b4f96..7587718114 100644 --- a/macros/base64decode.yml +++ b/macros/base64decode.yml @@ -1,10 +1,10 @@ name: base64decode id: fc2a1c3c-3251-418d-b411-7e62303e2cb3 -version: 1 +version: 2 creation_date: '2024-01-10' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: Content based conversion of UTF8/UTF16 based base64 encoding. Not a full implementation, but good enough for context without additional app installation. -definition: 'eval b64x_split=split($b64in$,"") | lookup char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?.{8})" max_match=0 | lookup char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"' +definition: 'eval b64x_split=split($b64in$,"") | lookup local=t char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?.{8})" max_match=0 | lookup local=t char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"' arguments: - b64in diff --git a/macros/remote_access_software_usage_exceptions.yml b/macros/remote_access_software_usage_exceptions.yml index 882b3c7b88..adeff11e2b 100644 --- a/macros/remote_access_software_usage_exceptions.yml +++ b/macros/remote_access_software_usage_exceptions.yml @@ -1,8 +1,8 @@ name: remote_access_software_usage_exceptions id: 4b0c9d7e-6fe2-404d-87b0-80e11c9a11f1 -version: 1 +version: 2 creation_date: '2024-07-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: Macro used with remote access monitoring content to define exception lookup and usage. Returns filtered results based on contents of remote_access_software_usage_exception.csv -definition: 'eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest) | lookup update=true asset_lookup_by_str asset as exception_asset OUTPUTNEW asset as asset_temp_field | eval asset_temp_field = CASE(isnull(asset_temp_field),exception_asset,true(),asset_temp_field ) | lookup remote_access_software_exceptions asset as asset_temp_field software as signature OUTPUT exception as rmm_exception, exception_date as rmm_exception_date, exception_ttl_days as rmm_exception_ttl_days, comment as rmm_exception_comment | eval rmm_exception = mvdedup(mvfilter(NOT match(rmm_exception,"false"))), rmm_exception_date = mvdedup(mvfilter(NOT match(rmm_exception_date,"false"))), rmm_exception_ttl_days = mvdedup(mvfilter(NOT match(rmm_exception_ttl_days,"false"))), rmm_exception_comment = mvdedup(mvfilter(NOT match(rmm_exception_comment,"false"))), rmm_exception_end_date = relative_time(strptime(rmm_exception_date, "%Y-%m-%d"), "+"+rmm_exception_ttl_days+"d"), rmm_exception_end = CASE((now() >= rmm_exception_end_date),"TRUE",(now() < rmm_exception_end_date),"FALSE",(match(rmm_exception,"(?i)true") AND isnull(rmm_exception_ttl_days)),"UNLIMITED") | search NOT (rmm_exception = TRUE AND rmm_exception_end IN ("FALSE","UNLIMITED")) | fields - asset_temp_field,exception_asset' +definition: 'eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest) | lookup local=t update=true asset_lookup_by_str asset as exception_asset OUTPUTNEW asset as asset_temp_field | eval asset_temp_field = CASE(isnull(asset_temp_field),exception_asset,true(),asset_temp_field ) | lookup local=t remote_access_software_exceptions asset as asset_temp_field software as signature OUTPUT exception as rmm_exception, exception_date as rmm_exception_date, exception_ttl_days as rmm_exception_ttl_days, comment as rmm_exception_comment | eval rmm_exception = mvdedup(mvfilter(NOT match(rmm_exception,"false"))), rmm_exception_date = mvdedup(mvfilter(NOT match(rmm_exception_date,"false"))), rmm_exception_ttl_days = mvdedup(mvfilter(NOT match(rmm_exception_ttl_days,"false"))), rmm_exception_comment = mvdedup(mvfilter(NOT match(rmm_exception_comment,"false"))), rmm_exception_end_date = relative_time(strptime(rmm_exception_date, "%Y-%m-%d"), "+"+rmm_exception_ttl_days+"d"), rmm_exception_end = CASE((now() >= rmm_exception_end_date),"TRUE",(now() < rmm_exception_end_date),"FALSE",(match(rmm_exception,"(?i)true") AND isnull(rmm_exception_ttl_days)),"UNLIMITED") | search NOT (rmm_exception = TRUE AND rmm_exception_end IN ("FALSE","UNLIMITED")) | fields - asset_temp_field,exception_asset' diff --git a/macros/suspicious_writes.yml b/macros/suspicious_writes.yml index 40c6421b8d..a86d06c69c 100644 --- a/macros/suspicious_writes.yml +++ b/macros/suspicious_writes.yml @@ -1,8 +1,8 @@ name: suspicious_writes id: 6983de37-2a08-4c42-80a2-fe404edd19b4 -version: 1 +version: 2 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: This macro limites the output to file names that have been marked as suspicious -definition: lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False +definition: lookup local=t suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False From 69bbd304ceec456a5dfecaab602e1bc4002afb1b Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Mon, 5 Oct 2026 05:59:11 -0400 Subject: [PATCH 133/164] Kerberloss Detections (#4296) --------- Co-authored-by: Nasreddine Bencherchali Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- ..._computer_spn_modified_by_user_account.yml | 96 ++++++++++++++++ ...ows_ad_spn_unicode_collision_injection.yml | 104 ++++++++++++++++++ 2 files changed, 200 insertions(+) create mode 100644 detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml create mode 100644 detections/endpoint/windows_ad_spn_unicode_collision_injection.yml diff --git a/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml b/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml new file mode 100644 index 0000000000..a2fef1d15e --- /dev/null +++ b/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml @@ -0,0 +1,96 @@ +name: Windows AD Computer SPN Modified By User Account +id: dbe30a35-b56d-4a7a-82c4-2433da06b342 +version: 1 +creation_date: '2026-09-25' +modification_date: '2026-09-25' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects a user account (non-machine account) adding or removing a servicePrincipalName (SPN) on a computer object in Active Directory, via Windows Security Event 5136. + In normal AD operations, SPN values on computer objects are managed exclusively by the computer account itself (during domain join or name change), by Domain Controllers during replication, or by the SYSTEM/NETWORK SERVICE context — all of which appear as accounts ending in the dollar sign ($) convention. + A named user account writing to the servicePrincipalName attribute of a computer object is anomalous and may indicate an attacker with delegated WriteProperty rights over computer accounts performing SPN manipulation. +data_source: + - Windows Event Log Security 5136 +search: |- + `wineventlog_security` + EventCode=5136 + AttributeLDAPDisplayName=servicePrincipalName + ObjectClass=computer + NOT SubjectUserName="*$" + NOT SubjectUserSid IN ( + "S-1-5-18", + "S-1-5-19", + "S-1-5-20" + ) + NOT SubjectUserName IN ( + "*ANONYMOUS*", + "*NT AUTHORITY*", + "*SYSTEM" + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(AttributeValue) as spn_values + values(OperationType) as operation_types + by Computer SubjectUserName SubjectDomainName SubjectUserSid ObjectDN + + | eval operation_types=mvmap(operation_types, case(operation_types="%%14675", "Deleted", operation_types="%%14674", "Added", true(), operation_types)) + + | rename Computer as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_computer_spn_modified_by_user_account_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. A WriteProperty audit SACL must also be configured on the computer object class (or CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified. +known_false_positives: |- + Administrators using tools such as setspn.exe, ADSI Edit, or PowerShell AD modules to manually manage SPNs on computer objects will trigger this detection. + Service account provisioning workflows and some third-party identity management platforms may also legitimately modify computer SPNs. + Review the SubjectUserName, ObjectDN, and spn_values fields to determine if the change is expected. + Consider adding known administrative accounts to the filter macro. +references: + - https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: SubjectUserName + type: user + score: 20 + message: User [$SubjectUserName$] modified SPNs on computer object [$ObjectDN$] on $dest$ +threat_objects: + - field: SubjectUserName + type: user +analytic_story: + - Active Directory Kerberos Attacks + - Compromised User Account + - Sneaky Active Directory Persistence Tricks +asset_type: Endpoint +cve: + - CVE-2026-25177 +mitre_attack_id: + - T1562.010 + - T1558.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml new file mode 100644 index 0000000000..bc34b8c481 --- /dev/null +++ b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml @@ -0,0 +1,104 @@ +name: Windows AD SPN Unicode Collision Injection +id: d2d2c043-57a6-4aca-be43-ebb402dbb9e5 +version: 1 +creation_date: '2026-09-25' +modification_date: '2026-09-25' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects the addition of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. + This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account's SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner). + LDAP's string preparation rules (RFC 4518) cause these characters to be ignored during uniqueness checking, allowing the write to succeed even when an identical SPN already exists on another machine account. + The Kerberos KDC, however, does not apply the same normalisation — it finds two accounts with matching SPNs and returns KDC_ERR_S_PRINCIPAL_UNKNOWN, causing a Kerberos denial-of-service or forcing clients to fall back to NTLM downgrade. +data_source: + - Windows Event Log Security 5136 +search: |- + `wineventlog_security` + EventCode=5136 + AttributeValue=* + AttributeLDAPDisplayName=servicePrincipalName + OperationType IN ( + "%%14674", + "%%14675" + ) + + | regex AttributeValue="[\x{034F}\x{200B}-\x{200F}\x{00AD}\x{1806}\x{FEFF}\x{FFFC}\x{2060}\x{206A}-\x{206F}\x{180B}-\x{180D}\x{FE00}-\x{FE0F}]" + + | eval matched_invisible_chars=mvappend( + if(match(AttributeValue, "\x{034F}"), "U+034F (Combining Grapheme Joiner)", null()), + if(match(AttributeValue, "\x{200B}"), "U+200B (Zero Width Space)", null()), + if(match(AttributeValue, "\x{200C}"), "U+200C (Zero Width Non-Joiner)", null()), + if(match(AttributeValue, "\x{200D}"), "U+200D (Zero Width Joiner)", null()), + if(match(AttributeValue, "\x{200E}"), "U+200E (Left-to-Right Mark)", null()), + if(match(AttributeValue, "\x{200F}"), "U+200F (Right-to-Left Mark)", null()), + if(match(AttributeValue, "\x{00AD}"), "U+00AD (Soft Hyphen)", null()), + if(match(AttributeValue, "\x{1806}"), "U+1806 (Mongolian Todo Soft Hyphen)", null()), + if(match(AttributeValue, "\x{FEFF}"), "U+FEFF (Zero Width No-Break Space)", null()), + if(match(AttributeValue, "\x{FFFC}"), "U+FFFC (Object Replacement Character)", null()), + if(match(AttributeValue, "\x{2060}"), "U+2060 (Word Joiner)", null()), + if(match(AttributeValue, "[\x{206A}-\x{206F}]"), "U+206A-206F (Deprecated Format Characters)", null()), + if(match(AttributeValue, "[\x{180B}-\x{180D}]"), "U+180B-180D (Variation Selectors)", null()), + if(match(AttributeValue, "[\x{FE00}-\x{FE0F}]"), "U+FE00-FE0F (Variation Selectors)", null())) + + | where isnotnull(matched_invisible_chars) + | rename Computer as dest + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(matched_invisible_chars) as matched_invisible_chars + by dest SubjectUserName SubjectDomainName ObjectDN ObjectClass AttributeValue + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_spn_unicode_collision_injection_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. Additionally, a WriteProperty audit SACL must be configured on the computer object class (or the CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified. +known_false_positives: |- + Legitimate use of invisible Unicode characters in SPN values is not expected. This detection should have a very low false positive rate. + Provisioning tools or scripts that incorrectly encode SPN strings from certain character sets may trigger this. + Verify the SubjectUserName and ObjectDN to confirm intent. +references: + - https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: User [$SubjectUserName$] injected an invisible-Unicode SPN [$matched_invisible_chars$] onto [$ObjectDN$] on $dest$ + entity: + field: SubjectUserName + type: user + score: 50 +threat_objects: + - field: AttributeValue + type: user +analytic_story: + - Active Directory Kerberos Attacks + - Compromised User Account + - Sneaky Active Directory Persistence Tricks +asset_type: Endpoint +cve: + - CVE-2026-25177 +mitre_attack_id: + - T1562.010 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit From fb58f09f959af48f795a7532739fe268ed367392 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:14:20 +0200 Subject: [PATCH 134/164] update wmi filters analytics --- .../windows_event_log_wmi_activity_5861.yml | 61 +++++++++++++ ...ect_wmi_event_subscription_persistence.yml | 11 ++- .../wmi_temporary_event_subscription.yml | 12 ++- .../wmi_permanent_event_subscription.yml | 87 ++++++++++++++----- ..._permanent_event_subscription___sysmon.yml | 30 +++---- 5 files changed, 153 insertions(+), 48 deletions(-) create mode 100644 data_sources/windows_event_log_wmi_activity_5861.yml rename detections/{endpoint => deprecated}/detect_wmi_event_subscription_persistence.yml (89%) rename detections/{endpoint => deprecated}/wmi_temporary_event_subscription.yml (82%) diff --git a/data_sources/windows_event_log_wmi_activity_5861.yml b/data_sources/windows_event_log_wmi_activity_5861.yml new file mode 100644 index 0000000000..ab1747e351 --- /dev/null +++ b/data_sources/windows_event_log_wmi_activity_5861.yml @@ -0,0 +1,61 @@ +name: Windows Event Log WMI Activity 5861 +id: dad572ee-2271-4a1c-b118-ae6c5494a7c1 +version: 1 +creation_date: '2026-10-05' +modification_date: '2026-10-05' +author: Nasreddine Bencherchali, Splunk +description: Logs the creation of a permanent WMI event subscription when an event filter is bound to an event consumer, including consumer and filter details. +mitre_components: + - WMI Creation + - Application Log Content + - OS API Execution +source: XmlWinEventLog:Microsoft-Windows-WMI-Activity/Operational +sourcetype: XmlWinEventLog +separator: EventID +separator_value: '5861' +supported_TA: [] +fields: + - _time + - Channel + - Computer + - EventCode + - System_Props_Xml + - UserData_Xml + - EventID + - EventRecordID + - Guid + - Keywords + - Level + - Opcode + - ProcessID + - SystemTime + - Task + - TaskCategory + - ThreadID + - UserID + - Version + - source + - sourcetype + - user_id + - vendor_product +output_fields: + - dest +example_log: |- + 586100000x400000000000000024669Microsoft-Windows-WMI-Activity/OperationalEC2AMAZ-1QDNI6F//./root/subscriptionAtomicRedTeam_filterCommandLineEventConsumer="AtomicRedTeam_consumer"Binding EventFilter: + instance of __EventFilter + { + CreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 95, 211, 181, 28, 123, 4, 131, 205, 168, 40, 205, 106, 244, 1, 0, 0}; + EventNamespace = "root\\subscription"; + Name = "AtomicRedTeam_filter"; + Query = "SELECT * FROM __InstanceCreationEvent Within 3 Where TargetInstance Isa \"Win32_Process\" And Targetinstance.Name = \"notepad.exe\" "; + QueryLanguage = "WQL"; + }; + Perm. Consumer: + instance of CommandLineEventConsumer + { + CommandLineTemplate = "cmd.exe"; + CreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 95, 211, 181, 28, 123, 4, 131, 205, 168, 40, 205, 106, 244, 1, 0, 0}; + Name = "AtomicRedTeam_consumer"; + RunInteractively = FALSE; + }; + diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/deprecated/detect_wmi_event_subscription_persistence.yml similarity index 89% rename from detections/endpoint/detect_wmi_event_subscription_persistence.yml rename to detections/deprecated/detect_wmi_event_subscription_persistence.yml index 779f9b78bb..2d746625cb 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/deprecated/detect_wmi_event_subscription_persistence.yml @@ -1,10 +1,10 @@ name: Detect WMI Event Subscription Persistence id: 01d9a0c2-cece-11eb-ab46-acde48001122 -version: 12 +version: 13 creation_date: '2021-06-16' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It detects EventID 19 (EventFilter creation), EventID 20 (EventConsumer creation), and EventID 21 (FilterToConsumerBinding creation) from Sysmon logs. This activity is significant because WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making it a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment. data_source: @@ -60,3 +60,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: This rule uses only Sysmon EventID 20, which records creation of a WMI event consumer but does not confirm that a filter is bound to it. The Sysmon permanent subscription detection covers the binding with EventID 21. + removed_in_version: 6.10.0 + replacement_content: + - WMI Permanent Event Subscription - Sysmon diff --git a/detections/endpoint/wmi_temporary_event_subscription.yml b/detections/deprecated/wmi_temporary_event_subscription.yml similarity index 82% rename from detections/endpoint/wmi_temporary_event_subscription.yml rename to detections/deprecated/wmi_temporary_event_subscription.yml index b08200b0fc..abe30ff297 100644 --- a/detections/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/deprecated/wmi_temporary_event_subscription.yml @@ -1,10 +1,10 @@ name: WMI Temporary Event Subscription id: 38cbd42c-1098-41bb-99cf-9d6d2b296d83 -version: 10 +version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Rico Valdez, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic detects the creation of WMI temporary event subscriptions. It leverages Windows Event Logs, specifically EventCode 5860, to identify these activities. This detection is significant because attackers often use WMI to execute commands, gather information, or maintain persistence within a compromised system. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, escalate privileges, or persist in the environment. Analysts should review the specific WMI queries and assess their intent, considering potential false positives from legitimate administrative tasks. data_source: [] @@ -43,3 +43,9 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: |- + This rule is deprecated in its current form because EventID 5860 identifies temporary subscriptions rather than permanent persistence, and the broad match with exact query-string exceptions does not reliably distinguish malicious use from legitimate software. + Temporary WMI activity may warrant a separate behavior-focused detection. + removed_in_version: 6.10.0 + replacement_content: [] diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 12a5ee8fb3..90cdca1ae4 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -1,43 +1,86 @@ name: WMI Permanent Event Subscription id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d -version: 10 +version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' -author: Rico Valdez, Splunk -status: experimental -type: TTP -description: The following analytic detects the creation of permanent event subscriptions using Windows Management Instrumentation (WMI). It leverages Sysmon EventID 5 data to identify instances where the event consumers are not the expected "NTEventLogEventConsumer." This activity is significant because it suggests an attacker is attempting to achieve persistence by running malicious scripts or binaries in response to specific system events. If confirmed malicious, this could lead to severe impacts such as data theft, ransomware deployment, or other damaging outcomes. Investigate the associated scripts or binaries to identify the source of the attack. -data_source: [] +modification_date: '2026-10-05' +author: Rico Valdez, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Detects WMI permanent event subscriptions from Windows WMI-Activity EventID 5861. +data_source: + - Windows Event Log WMI Activity 5861 search: |- `wmi` EventCode=5861 - Binding - | rex field=Message "Consumer =\s+(?[^;|^$]+)" - | search consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" + | spath input=_raw output=possible_cause path=Event.UserData.Operation_ESStoConsumerBinding.PossibleCause + | spath input=_raw output=consumer_xml path=Event.UserData.Operation_ESStoConsumerBinding.CONSUMER + | eval possible_cause=coalesce(possible_cause, Message) + | rex field=Message "(?i)Consumer\s*=\s*(?[^;\r\n]+)" + | eval consumer=coalesce(consumer_xml, consumer_message) + | where isnull(consumer) OR consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" + | rex field=possible_cause "(?ms)instance of __EventFilter\s+\{(?.*?)\};\s*Perm\. Consumer:" + | rex field=event_filter "(?m)^\s*Name\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=event_filter "(?m)^\s*Query\s*=\s*\"(?.*?)\"\s*;" + | rex field=event_filter "(?m)^\s*EventNamespace\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=event_filter "(?m)^\s*QueryLanguage\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=possible_cause "(?s)Perm\. Consumer:\s+instance of (?[A-Za-z0-9_]+)\s+\{(?.*?)\};\s*\Z" + | rex field=consumer_properties "(?m)^\s*Name\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=consumer_properties "(?m)^\s*CommandLineTemplate\s*=\s*\"(?.*?)\"\s*;" + | rex field=consumer_properties "(?m)^\s*RunInteractively\s*=\s*(?[^;]+)\s*;" + | rex field=consumer_properties "(?m)^\s*ScriptingEngine\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=consumer_properties "(?ms)^\s*ScriptText\s*=\s*\"(?.*?)\"\s*;\s*$" + | where consumer_type IN ("CommandLineEventConsumer", "ActiveScriptEventConsumer") + | eval command=coalesce(command_line_template, script_text) + | fillnull value=NULL | stats count min(_time) as firstTime max(_time) as lastTime - by ComputerName, consumer, Message + values(consumer) as consumer + values(consumer_type) as consumer_type + values(consumer_name) as consumer_name + values(command_line_template) as command_line_template + values(run_interactively) as run_interactively + values(scripting_engine) as scripting_engine + values(script_text) as script_text + values(command) as command + by Computer, filter_name, filter_query, filter_event_namespace, filter_query_language | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename ComputerName as dest + | rename Computer as dest | `wmi_permanent_event_subscription_filter` -how_to_implement: To successfully implement this search, you must be ingesting the Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational]. -known_false_positives: Although unlikely, administrators may use event subscriptions for legitimate purposes. -references: [] -finding: - title: WMI Permanent Event Subscription detected on $dest$ - entity: - field: dest - type: system - score: 50 +how_to_implement: |- + Ingest Microsoft-Windows-WMI-Activity/Operational events and ensure EventCode, Computer, and the raw XML event are available. + The search uses spath to extract the binding details, then regex to parse the embedded __EventFilter and the supported CommandLineEventConsumer and ActiveScriptEventConsumer properties. For non-XML rendered events, Message is used as a fallback for the consumer details. +known_false_positives: |- + Administrators and software may use permanent WMI event subscriptions. Review the consumer, filter query, and creator context; tune known authorized subscriptions with the detection filter macro. +references: + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/binding-an-event-filter-with-a-logical-consumer + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/activescripteventconsumer +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: WMI event filter [$filter_name$] in [$filter_event_namespace$] watches [$filter_query$] and is bound to [$consumer_type$] [$consumer_name$] on [$dest$], which can execute [$command$]. +threat_objects: + - field: command + type: command analytic_story: - Suspicious WMI Use asset_type: Endpoint mitre_attack_id: - - T1047 + - T1546.003 product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud category: endpoint security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team_wmi_subscription/wmi.log + source: XmlWinEventLog:Microsoft-Windows-WMI-Activity/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index f876f349a2..5408d149b8 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -1,28 +1,24 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 -version: 12 +version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Rico Valdez, Michael Haag, Splunk status: production -type: TTP -description: The following analytic identifies the creation of WMI permanent event subscriptions, which can be used to establish persistence or perform privilege escalation. It leverages Sysmon data, specifically EventCodes 19, 20, and 21, to detect the creation of WMI EventFilters, EventConsumers, and FilterToConsumerBindings. This activity is significant as it may indicate an attacker setting up mechanisms to execute code with elevated SYSTEM privileges when specific events occur. If confirmed malicious, this could allow the attacker to maintain persistence, escalate privileges, and execute arbitrary code, posing a severe threat to the environment. +type: Anomaly +description: |- + Detects creation of a WMI permanent event subscription using Sysmon EventID 21. The event identifies the consumer and filter that were bound, showing what will run and which event condition triggers it. data_source: - Sysmon EventID 21 search: |- - `sysmon` EventCode=21 + `sysmon` EventCode=21 Operation=Created | stats count min(_time) as firstTime max(_time) as lastTime - BY dest dvc object - object_attrs object_category object_path - signature signature_id src - status user user_id - vendor_product Consumer ConsumerNoQuotes - Filter FilterNoQuotes + BY dest user Consumer Filter | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_permanent_event_subscription___sysmon_filter` -how_to_implement: To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. -known_false_positives: Although unlikely, administrators may use event subscriptions for legitimate purposes. +how_to_implement: Collect Sysmon WMI events and parse EventID 21, including the Operation, destination, user, Consumer, and Filter fields. Sysmon EventID 21 is emitted when a consumer is bound to a filter. +known_false_positives: Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ @@ -37,18 +33,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: WMI Permanent Event Subscription detected on $dest$ by $user$ - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system score: 50 - message: WMI Permanent Event Subscription detected on $dest$ by $user$ + message: A WMI consumer-to-filter binding was on [$dest$] by [$user$] consumer - [$Consumer$] was bound to filter [$Filter$]. analytic_story: - Suspicious WMI Use asset_type: Endpoint From d032dd9e71ed9e3a4888e9e31a85aa00341e1f82 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:17:14 +0200 Subject: [PATCH 135/164] Update wmi_permanent_event_subscription___sysmon.yml --- ..._permanent_event_subscription___sysmon.yml | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 5408d149b8..9a6f4e32e1 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -7,18 +7,25 @@ author: Rico Valdez, Michael Haag, Splunk status: production type: Anomaly description: |- - Detects creation of a WMI permanent event subscription using Sysmon EventID 21. The event identifies the consumer and filter that were bound, showing what will run and which event condition triggers it. + Detects the creation of a WMI permanent event subscription using Sysmon EventID 21. data_source: - Sysmon EventID 21 search: |- - `sysmon` EventCode=21 Operation=Created - | stats count min(_time) as firstTime max(_time) as lastTime + `sysmon` + EventCode=21 + Operation=Created + + | stats count min(_time) as firstTime + max(_time) as lastTime BY dest user Consumer Filter - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `wmi_permanent_event_subscription___sysmon_filter` -how_to_implement: Collect Sysmon WMI events and parse EventID 21, including the Operation, destination, user, Consumer, and Filter fields. Sysmon EventID 21 is emitted when a consumer is bound to a filter. -known_false_positives: Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro. + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `wmi_permanent_event_subscription___sysmon_filter` +how_to_implement: |- + To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. +known_false_positives: |- + Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ From 152e2f57cd28a9792d4329e3f7de3775656665dc Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:20:42 +0200 Subject: [PATCH 136/164] New Approach on Handling Renamed Binaries (#4283) --------- Co-authored-by: Nasreddine Bencherchali --- .../detect_html_help_renamed.yml | 11 +- .../detect_mshta_renamed.yml | 11 +- .../detect_renamed_7_zip.yml | 11 +- .../detect_renamed_psexec.yml | 11 +- .../detect_renamed_rclone.yml | 11 +- .../detect_renamed_winrar.yml | 11 +- ...ous_microsoft_workflow_compiler_rename.yml | 11 +- .../suspicious_msbuild_rename.yml | 11 +- ...indows_lolbas_executed_as_renamed_file.yml | 9 +- .../windows_regsvr32_renamed_binary.yml | 11 +- .../windows_renamed_powershell_execution.yml | 11 +- ...named_command_interpreter_was_executed.yml | 109 +++++++++++++ ...ows_renamed_lolbas_binary_was_executed.yml | 114 ++++++++++++++ ...opular_3rd_party_software_was_executed.yml | 107 +++++++++++++ ...ows_renamed_python_binary_was_executed.yml | 91 +++++++++++ lookups/csv/renamed_lolbas_binaries.csv | 147 ++++++++++++++++++ lookups/csv/renamed_lolbas_binaries.yml | 14 ++ .../renamed_popular_3rd_party_binaries.csv | 43 +++++ .../renamed_popular_3rd_party_binaries.yml | 14 ++ ...d_windows_command_interpreter_binaries.csv | 14 ++ ...d_windows_command_interpreter_binaries.yml | 14 ++ 21 files changed, 754 insertions(+), 32 deletions(-) rename detections/{endpoint => deprecated}/detect_html_help_renamed.yml (89%) rename detections/{endpoint => deprecated}/detect_mshta_renamed.yml (88%) rename detections/{endpoint => deprecated}/detect_renamed_7_zip.yml (88%) rename detections/{endpoint => deprecated}/detect_renamed_psexec.yml (89%) rename detections/{endpoint => deprecated}/detect_renamed_rclone.yml (88%) rename detections/{endpoint => deprecated}/detect_renamed_winrar.yml (87%) rename detections/{endpoint => deprecated}/suspicious_microsoft_workflow_compiler_rename.yml (89%) rename detections/{endpoint => deprecated}/suspicious_msbuild_rename.yml (89%) rename detections/{endpoint => deprecated}/windows_lolbas_executed_as_renamed_file.yml (95%) rename detections/{endpoint => deprecated}/windows_regsvr32_renamed_binary.yml (90%) rename detections/{endpoint => deprecated}/windows_renamed_powershell_execution.yml (91%) create mode 100644 detections/endpoint/windows_renamed_command_interpreter_was_executed.yml create mode 100644 detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml create mode 100644 detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml create mode 100644 detections/endpoint/windows_renamed_python_binary_was_executed.yml create mode 100644 lookups/csv/renamed_lolbas_binaries.csv create mode 100644 lookups/csv/renamed_lolbas_binaries.yml create mode 100644 lookups/csv/renamed_popular_3rd_party_binaries.csv create mode 100644 lookups/csv/renamed_popular_3rd_party_binaries.yml create mode 100644 lookups/csv/renamed_windows_command_interpreter_binaries.csv create mode 100644 lookups/csv/renamed_windows_command_interpreter_binaries.yml diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/deprecated/detect_html_help_renamed.yml similarity index 89% rename from detections/endpoint/detect_html_help_renamed.yml rename to detections/deprecated/detect_html_help_renamed.yml index e9d228305a..6a71fb8028 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/deprecated/detect_html_help_renamed.yml @@ -1,10 +1,10 @@ name: Detect HTML Help Renamed id: 62fed254-513b-460e-953d-79771493a9f3 -version: 14 +version: 15 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects instances where hh.exe (HTML Help) has been renamed and is executing a Compiled HTML Help (CHM) file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because attackers can use renamed hh.exe to execute malicious scripts embedded in CHM files, potentially leading to code execution. If confirmed malicious, this technique could allow attackers to run arbitrary scripts, escalate privileges, or persist within the environment, posing a significant security risk. data_source: @@ -53,3 +53,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/deprecated/detect_mshta_renamed.yml similarity index 88% rename from detections/endpoint/detect_mshta_renamed.yml rename to detections/deprecated/detect_mshta_renamed.yml index e04f4d7434..a18668a17f 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/deprecated/detect_mshta_renamed.yml @@ -1,10 +1,10 @@ name: Detect mshta renamed id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 -version: 13 +version: 14 creation_date: '2021-01-15' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where mshta.exe has been renamed and executed. It leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original file name field to detect discrepancies. This activity is significant because renaming mshta.exe is a common tactic used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/deprecated/detect_renamed_7_zip.yml similarity index 88% rename from detections/endpoint/detect_renamed_7_zip.yml rename to detections/deprecated/detect_renamed_7_zip.yml index 667a8ad2f5..fea1e5e5ce 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/deprecated/detect_renamed_7_zip.yml @@ -1,10 +1,10 @@ name: Detect Renamed 7-Zip id: 4057291a-b8cf-11eb-95fe-acde48001122 -version: 12 +version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the usage of a renamed 7-Zip executable using Sysmon data. It leverages the OriginalFileName field to identify instances where the 7-Zip process has been renamed. This activity is significant as attackers often rename legitimate tools to evade detection while staging or exfiltrating data. If confirmed malicious, this behavior could indicate data exfiltration attempts or other unauthorized data manipulation, potentially leading to significant data breaches or loss of sensitive information. Analysts should validate the legitimacy of the 7-Zip executable and investigate parallel processes for further suspicious activities. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/deprecated/detect_renamed_psexec.yml similarity index 89% rename from detections/endpoint/detect_renamed_psexec.yml rename to detections/deprecated/detect_renamed_psexec.yml index 2e56a88379..52e1bdf889 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/deprecated/detect_renamed_psexec.yml @@ -1,10 +1,10 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 17 +version: 18 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk, Alex Oberkircher, Github Community -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where `PsExec.exe` has been renamed and executed on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because renaming `PsExec.exe` is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network. data_source: @@ -67,3 +67,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Command Interpreter was Executed diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/deprecated/detect_renamed_rclone.yml similarity index 88% rename from detections/endpoint/detect_renamed_rclone.yml rename to detections/deprecated/detect_renamed_rclone.yml index d7bbfa5d71..7e9bccd333 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/deprecated/detect_renamed_rclone.yml @@ -1,10 +1,10 @@ name: Detect Renamed RClone id: 6dca1124-b3ec-11eb-9328-acde48001122 -version: 12 +version: 13 creation_date: '2021-05-13' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the execution of a renamed `rclone.exe` process, which is commonly used for data exfiltration to remote destinations. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and original file names that do not match. This activity is significant because ransomware groups often use RClone to exfiltrate sensitive data. If confirmed malicious, this behavior could indicate an ongoing data exfiltration attempt, potentially leading to significant data loss and further compromise of the affected systems. data_source: @@ -56,3 +56,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/deprecated/detect_renamed_winrar.yml similarity index 87% rename from detections/endpoint/detect_renamed_winrar.yml rename to detections/deprecated/detect_renamed_winrar.yml index 5779de2a81..215d1d0a53 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/deprecated/detect_renamed_winrar.yml @@ -1,10 +1,10 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: 16 +version: 17 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where `WinRAR.exe` has been renamed and executed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because renaming executables is a common tactic used by attackers to evade detection. If confirmed malicious, this could indicate an attempt to bypass security controls, potentially leading to unauthorized data extraction or further system compromise. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml similarity index 89% rename from detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml rename to detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml index 21f34aefa8..ec137b5b28 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml @@ -1,10 +1,10 @@ name: Suspicious microsoft workflow compiler rename id: f0db4464-55d9-11eb-ae93-0242ac130002 -version: 14 +version: 15 creation_date: '2021-01-19' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the renaming of microsoft.workflow.compiler.exe, a rarely used executable typically located in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process names and original file names. This activity is significant because renaming this executable can indicate an attempt to evade security controls. If confirmed malicious, an attacker could use this renamed executable to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. data_source: @@ -56,3 +56,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/deprecated/suspicious_msbuild_rename.yml similarity index 89% rename from detections/endpoint/suspicious_msbuild_rename.yml rename to detections/deprecated/suspicious_msbuild_rename.yml index 7a4091f310..4fb2bbb641 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/deprecated/suspicious_msbuild_rename.yml @@ -1,10 +1,10 @@ name: Suspicious MSBuild Rename id: 4006adac-5937-11eb-ae93-0242ac130002 -version: 14 +version: 15 creation_date: '2021-01-15' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the execution of renamed instances of msbuild.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because msbuild.exe is a legitimate tool often abused by attackers to execute malicious code while evading detection. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: @@ -58,3 +58,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml similarity index 95% rename from detections/endpoint/windows_lolbas_executed_as_renamed_file.yml rename to detections/deprecated/windows_lolbas_executed_as_renamed_file.yml index 93cd636e66..94d1538a1a 100644 --- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml +++ b/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml @@ -2,9 +2,9 @@ name: Windows LOLBAS Executed As Renamed File id: fd496996-7d9e-4894-8d40-bb85b6192dc6 version: 11 creation_date: '2024-05-03' -modification_date: '2026-09-22' +modification_date: '2026-09-23' author: Steven Dick -status: production +status: deprecated type: TTP description: The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. data_source: @@ -63,3 +63,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to renaming of its newer version. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_regsvr32_renamed_binary.yml b/detections/deprecated/windows_regsvr32_renamed_binary.yml similarity index 90% rename from detections/endpoint/windows_regsvr32_renamed_binary.yml rename to detections/deprecated/windows_regsvr32_renamed_binary.yml index 883a47c7e4..4d6940c412 100644 --- a/detections/endpoint/windows_regsvr32_renamed_binary.yml +++ b/detections/deprecated/windows_regsvr32_renamed_binary.yml @@ -1,10 +1,10 @@ name: Windows Regsvr32 Renamed Binary id: 7349a9e9-3cf6-4171-bb0c-75607a8dcd1a -version: 13 +version: 14 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies instances where the regsvr32.exe binary has been renamed and executed. This detection leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original filename metadata. Renaming regsvr32.exe is significant as it can be an evasion technique used by attackers to bypass security controls. If confirmed malicious, this activity could allow an attacker to execute arbitrary DLLs, potentially leading to code execution, privilege escalation, or persistence within the environment. data_source: @@ -65,3 +65,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_renamed_powershell_execution.yml b/detections/deprecated/windows_renamed_powershell_execution.yml similarity index 91% rename from detections/endpoint/windows_renamed_powershell_execution.yml rename to detections/deprecated/windows_renamed_powershell_execution.yml index bade4e80af..dbb8ef8e18 100644 --- a/detections/endpoint/windows_renamed_powershell_execution.yml +++ b/detections/deprecated/windows_renamed_powershell_execution.yml @@ -1,10 +1,10 @@ name: Windows Renamed Powershell Execution id: c08014de-cc5a-42de-9775-76ecd5b37bbd -version: 8 +version: 9 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies instances where the PowerShell executable has been renamed and executed under an alternate filename. This behavior is commonly associated with attempts to evade security controls or bypass logging mechanisms that monitor standard PowerShell usage. While rare in legitimate environments, renamed PowerShell binaries are frequently observed in malicious campaigns leveraging Living-off-the-Land Binaries (LOLBins) and fileless malware techniques. This detection flags executions of PowerShell where the process name does not match the default powershell.exe or pwsh.exe, especially when invoked from unusual paths or accompanied by suspicious command-line arguments. data_source: @@ -49,3 +49,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Command Interpreter was Executed diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml new file mode 100644 index 0000000000..3e97a3ea43 --- /dev/null +++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml @@ -0,0 +1,109 @@ +name: Windows Renamed Command Interpreter was Executed +id: 6f4611be-076e-4fa8-bc78-466588a71442 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a Windows command interpreter process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + NOT Processes.original_file_name IN ("-","unknown") + [ + | inputlookup renamed_windows_command_interpreter_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + NOT [ + | inputlookup renamed_windows_command_interpreter_binaries + | rename original_file_name as Processes.process_name + | table Processes.process_name + ] + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval original_file_name=lower(original_file_name) + + | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) + | where NOT match(process_name, "(?i)".original_file_name) + + | lookup local=t renamed_windows_command_interpreter_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_command_interpreter_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries sharing the same name as Windows command interpreter binaries may trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://attack.mitre.org/techniques/T1059/ + - https://redcanary.com/threat-detection-report/techniques/rename-system-utilities/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Command Interpreter [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Suspicious Command-Line Executions + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml new file mode 100644 index 0000000000..f0842c81eb --- /dev/null +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -0,0 +1,114 @@ +name: Windows Renamed LOLBAS Binary was Executed +id: 10c3850e-810d-41b4-a197-2f14d7883579 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Steven Dick, Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. + The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + NOT Processes.original_file_name IN ("-","unknown") + [ + | inputlookup renamed_lolbas_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + NOT [ + | inputlookup renamed_lolbas_binaries + | rename original_file_name as Processes.process_name + | table Processes.process_name + ] + NOT process_name IN ( + "excelcnv.exe", + "installutil64.exe", + "protoc~1.exe", + "regwrite.exe", + "vzshadow.exe" + ) + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval original_file_name=lower(original_file_name) + + | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) + | where NOT match(process_name, "(?i)".original_file_name) + + | lookup local=t renamed_lolbas_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_lolbas_binary_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries sharing the same name as LOLBAS utilities may trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://redcanary.com/threat-detection-report/techniques/rename-system-utilities/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: LOLBAS utility [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml new file mode 100644 index 0000000000..374458d818 --- /dev/null +++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml @@ -0,0 +1,107 @@ +name: Windows Renamed Popular 3rd Party Software was Executed +id: cf6713c7-ac6b-4963-83a6-39f24ed10aa8 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a popular 3rd party software process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + NOT Processes.original_file_name IN ("-","unknown") + [ + | inputlookup renamed_popular_3rd_party_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + NOT [ + | inputlookup renamed_popular_3rd_party_binaries + | rename original_file_name as Processes.process_name + | table Processes.process_name + ] + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval original_file_name=lower(original_file_name) + + | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) + | where NOT match(process_name, "(?i)".original_file_name) + + | lookup local=t renamed_popular_3rd_party_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_popular_3rd_party_software_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries might have overlapping executable names. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/ + - https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Windows 3rd Party software [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_python_binary_was_executed.yml b/detections/endpoint/windows_renamed_python_binary_was_executed.yml new file mode 100644 index 0000000000..4f0731c451 --- /dev/null +++ b/detections/endpoint/windows_renamed_python_binary_was_executed.yml @@ -0,0 +1,91 @@ +name: Windows Renamed Python Binary was Executed +id: 6735153f-2da0-4eba-a428-288898613837 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a Python process being executed where it's process name does not match + it's original file name attribute. Processes that have been renamed and executed may be an indicator that + an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime + FROM datamodel=Endpoint.Processes + WHERE + Processes.original_file_name IN ( + "py*", + "python*", + "ipyw*" + ) + NOT Processes.original_file_name IN ("-","unknown") + NOT Processes.process_name IN ("dwagent.exe", "WinUtils.exe") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | eval original_file_name=lower(original_file_name) + | regex original_file_name="(?i)^(?:py|pyw|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+)\.exe$" + | regex process_name!="(?i)^(?:py|pyw|pip|pip3|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+|pip3\.\w+|idle3\.\w+)\.exe$" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_python_binary_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: Various Python implementations might have a different executable name, which could trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://attack.mitre.org/techniques/T1059/006/ + - https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Python binary [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 + - T1059.006 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/lookups/csv/renamed_lolbas_binaries.csv b/lookups/csv/renamed_lolbas_binaries.csv new file mode 100644 index 0000000000..ba83e577f1 --- /dev/null +++ b/lookups/csv/renamed_lolbas_binaries.csv @@ -0,0 +1,147 @@ +original_file_name,description +acccheckconsole.exe,Verifies UI accessibility requirements +addinutil.exe,.NET Tool used for updating cache files for Microsoft Office Add-Ins. +adplus.exe,Debugging tool included with Windows Debugging Tools +agentexecutor.exe,Intune Management Extension included on Intune Managed Devices +appcert.exe,Windows App Certification Kit command-line tool. +appinstaller.exe,Tool used for installation of AppX/MSIX applications on Windows 10 +appvlp.exe,Application Virtualization Utility Included with Microsoft Office 2016 +aspnet_compiler.exe,ASP.NET Compilation Tool +at.exe,Schedule periodic tasks +atbroker.exe,Helper binary for Assistive Technology (AT) +bitsadmin.exe,Used for managing background intelligent transfer +cdb.exe,Debugging tool included with Windows Debugging Tools. +certoc.exe,Used for installing certificates +certreq.exe,Used for requesting and managing certificates +certutil.exe,Windows binary used for handling certificates +cmdkey.exe,"creates, lists, and deletes stored user names and passwords or credentials." +cmdl32.exe,Microsoft Connection Manager Auto-Download +cmstp.exe,Installs or removes a Connection Manager service profile. +colorcpl.exe,Binary that handles color management +conhost.exe,Console Window host +control.exe,Console Window host +csc.exe,Binary file used by .NET to compile C# code +cscript.exe,Binary used to execute scripts in Windows +csi.exe,Command line interface included with Visual Studio. +curl.exe,Used for transferring data to or from a server; bundled with Windows 10 1803+ and can be used to download or upload files (not in repo lookup - added manually) +customshellhost.exe,A host process that is used by custom shells when using Windows in Kiosk mode. +datasvcutil.exe,DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application. +desktopimgdownldr.exe,Windows binary used to configure lockscreen/desktop image +devicecredentialdeployment.exe,Device Credential Deployment +devinit.exe,Visual Studio 2019 tool +devtoolslauncher.exe,Binary will execute specified binary. Part of VS/VScode installation. +dfsvc.exe,ClickOnce engine in Windows used by .NET +diantz.exe,Binary that package existing files into a cabinet (.cab) file +diskshadow.exe,Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). +dnscmd.exe,A command-line interface for managing DNS servers +dotnet.exe,dotnet.exe comes with .NET Framework +dsdbutil.exe,Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory. +dumpminitool.exe,Dump tool part Visual Studio 2022 +dxcap.exe,DirectX diagnostics/debugger included with Visual Studio. +esentutl.exe,Binary for working with Microsoft Joint Engine Technology (JET) database +eventvwr.exe,Displays Windows Event Logs in a GUI window. +excel.exe,Microsoft Office binary +expand.exe,Binary that expands one or more compressed files +extexport.exe,Load a DLL located in the C:\test folder with a specific name. +extrac32.exe,"Extract to ADS, copy or overwrite a file with Extrac32.exe" +findstr.exe,"Write to ADS, discover, or download files with Findstr.exe" +finger.exe,Displays information about a user or users on a specified remote computer that is running the Finger service or daemon +fltmc.exe,Filter Manager Control Program used by Windows +forfiles.exe,Selects and executes a command on a file or set of files. This command is useful for batch processing. +fsi.exe,64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK. +fsianycpu.exe,32/64-bit FSharp (F#) Interpreter included with Visual Studio. +fsutil.exe,File System Utility +ftp.exe,A binary designed for connecting to FTP servers +gfxdownloadwrapper.exe,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path." +gpscript.exe,Used by group policy to process scripts +hh.exe,Binary used for processing chm files in Windows +ie4uinit.exe,Executes commands from a specially prepared ie4uinit.inf file. +iediagcmd.exe,Diagnostics Utility for Internet Explorer +ieexec.exe,The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL. +ilasm.exe,used for compile c# code into dll or exe. +imewdbld.exe,Microsoft IME Open Extended Dictionary Module +infdefaultinstall.exe,Binary used to perform installation based on content inside inf files +installutil.exe,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies +jsc.exe,Binary file used by .NET to compile javascript code to .exe or .dll format +ldifde.exe,"Creates, modifies, and deletes LDAP directory objects." +makecab.exe,Binary to package existing files into a cabinet (.cab) file +manage-bde.wsf,Script for managing BitLocker +mavinject.exe,Used by App-v in Windows +mftrace.exe,Trace log generation tool for Media Foundation Tools. +microsoft.nodejstools.pressanykey.exe,Part of the NodeJS Visual Studio tools. +microsoft.workflow.compiler.exe,A utility included with .NET that is capable of compiling and executing C# or VB.net code. +mmc.exe,Load snap-ins to locally and remotely manage Windows systems +msaccess.exe,Microsoft Office binary +msbuild.exe,Used to compile and execute code +msconfig.exe,"MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows" +msdeploy.exe,Microsoft tool used to deploy Web Applications. +msdt.exe,Microsoft diagnostics tool +mshta.exe,Used by Windows to execute html applications. (.hta) +msiexec.exe,Used by Windows to execute msi files +msohtmed.exe,Microsoft Office binary +mspub.exe,Microsoft Office binary +netsh.exe,Netsh is a Windows tool used to manipulate network interface settings. +ntdsutil.exe,Command line utility used to export Active Directory. +odbcconf.exe,Used in Windows for managing ODBC connections +offlinescannershell.exe,Windows Defender Offline Shell +pcalua.exe,Program Compatibility Assistant +pcwrun.exe,Program Compatibility Wizard +pktmon.exe,Capture Network Packets on the windows 10 with October 2018 Update or later. +pnputil.exe,Used for installing drivers +powerpnt.exe,Microsoft Office binary +presentationhost.exe,File is used for executing Browser applications +print.exe,Used by Windows to send files to the printer +printbrm.exe,Printer Migration Command-Line Tool +protocolhandler.exe,Microsoft Office binary +provlaunch.exe,Launcher process +psr.exe,"Windows Problem Steps Recorder, used to record screen and clicks." +rasautou.exe,Windows Remote Access Dialer +rdrleakdiag.exe,Microsoft Windows resource leak diagnostic tool +reg.exe,Used to manipulate the registry +regasm.exe,Part of .NET +regedit.exe,Used by Windows to manipulate registry +regini.exe,Used to manipulate the registry +register-cimprovider.exe,Used to register new wmi providers +regsvcs.exe,Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies +regsvr32.exe,Used by Windows to register dlls +replace.exe,Used to replace file with another file +rpcping.exe,Used to verify rpc connection +rundll32.exe,Used by Windows to execute dll files +runexehelper.exe,Launcher process +runonce.exe,Executes a Run Once Task that has been configured in the registry +sc.exe,Used by Windows to manage services +schtasks.exe,Schedule periodic tasks +scriptrunner.exe,Execute binary through proxy binary to evade defensive counter measures +setres.exe,Configures display settings +settingsynchost.exe,Host Process for Setting Synchronization +sqldumper.exe,Debugging utility included with Microsoft SQL. +sqlps.exe,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons." +sqltoolsps.exe,Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+. +stordiag.exe,Storage diagnostic tool +syncappvpublishingserver.exe,Used by App-v to get App-v server lists +tar.exe,Used by Windows to extract and create archives. +testwindowremoteagent.exe,TestWindowRemoteAgent.exe is the command-line tool to establish RPC +ttdinject.exe,Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe) +tttracer.exe,Used by Windows 1809 and newer to Debug Time Travel +unregmp2.exe,Microsoft Windows Media Player Setup Utility +vbc.exe,Binary file used for compile vbs code +verclsid.exe,Used to verify a COM object before it is instantiated by Windows Explorer +visualuiaverifynative.exe,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls. +vsdiagnostics.exe,Command-line tool used for performing diagnostics. +vshadow.exe,VShadow is a command-line tool that can be used to create and manage volume shadow copies. +vsiisexelauncher.exe,Binary will execute specified binary. Part of VS/VScode installation. +vsjitdebugger.exe,Just-In-Time (JIT) debugger included with Visual Studio +vsls-agent.exe,Agent for Visual Studio Live Share (Code Collaboration) +vstest.console.exe,VSTest.Console.exe is the command-line tool to run tests +wab.exe,Windows address book manager +wbadmin.exe,Windows Backup Administration utility +wfc.exe,The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK). +winproj.exe,Microsoft Project Executable +winword.exe,Microsoft Office binary +wlrmdr.exe,Windows Logon Reminder executable +wmic.exe,The WMI command-line (WMIC) utility provides a command-line interface for WMI +workfolders.exe,Work Folders +wscript.exe,Used by Windows to execute scripts +wsreset.exe,Used to reset Windows Store settings according to its manifest file +wuauclt.exe,Windows Update Client +xwizard.exe,Execute custom class that has been added to the registry or download a file with Xwizard.exe diff --git a/lookups/csv/renamed_lolbas_binaries.yml b/lookups/csv/renamed_lolbas_binaries.yml new file mode 100644 index 0000000000..e76d3c3169 --- /dev/null +++ b/lookups/csv/renamed_lolbas_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_lolbas_binaries +id: 8fcee872-392f-41ab-95fb-a50f8557b03e +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of LOLBAS binaries and detailed information regarding their usage +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false diff --git a/lookups/csv/renamed_popular_3rd_party_binaries.csv b/lookups/csv/renamed_popular_3rd_party_binaries.csv new file mode 100644 index 0000000000..d2a52926d0 --- /dev/null +++ b/lookups/csv/renamed_popular_3rd_party_binaries.csv @@ -0,0 +1,43 @@ +original_file_name,description +7z.exe,7-Zip +7zg.exe,7-Zip +7zfm.exe,7-Zip +7za.exe,7-Zip +winrar*.exe,WinRAR +rar.exe,WinRAR +unrar.exe,WinRAR +peazip.exe,PeaZip +anydesk.exe,AnyDesk +teamviewer*.exe,TeamViewer +tv_w32.exe,TeamViewer +tv_x64.exe,TeamViewer +screenconnect*.exe,ConnectWise ScreenConnect +ateraagent.exe,Atera +srserver.exe,Splashtop +splashtopstreamer.exe,Splashtop +lmiguardiansvc.exe,LogMeIn +logmein.exe,LogMeIn +basupsrvc.exe,N-able Take Control +tcclient.exe,N-able Take Control +action1_agent.exe,Action1 +rutserv.exe,Remote Utilities +rfusclient.exe,Remote Utilities +advanced_ip_scanner*.exe,Advanced IP Scanner +advanced_port_scanner*.exe,Advanced Port Scanner +netscan.exe,SoftPerfect Network Scanner +ipscan.exe,Angry IP Scanner +adfind*.exe,AdFind +processhacker.exe,Process Hacker +systeminformer.exe,System Informer +winscp*.exe,WinSCP +rclone.exe,Rclone +plink.exe,PuTTY +putty*.exe,PuTTY +mobaxterm.exe,MobaXterm +ngrok.exe,Ngrok +cloudflared.exe,Cloudflared +chisel.exe,Chisel +webbrowserpassview.exe,NirSoft WebBrowserPassView +mailpv.exe,NirSoft Mail PassView +autoit3.exe,AutoIt +aut2exe.exe,AutoIt diff --git a/lookups/csv/renamed_popular_3rd_party_binaries.yml b/lookups/csv/renamed_popular_3rd_party_binaries.yml new file mode 100644 index 0000000000..0c684fe5e1 --- /dev/null +++ b/lookups/csv/renamed_popular_3rd_party_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_popular_3rd_party_binaries +id: 83a56371-0a0f-4486-be21-8dc1d4d25e97 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of popular 3rd party Windows binaries and their software names +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false diff --git a/lookups/csv/renamed_windows_command_interpreter_binaries.csv b/lookups/csv/renamed_windows_command_interpreter_binaries.csv new file mode 100644 index 0000000000..8809169991 --- /dev/null +++ b/lookups/csv/renamed_windows_command_interpreter_binaries.csv @@ -0,0 +1,14 @@ +original_file_name,description +bash.exe,"Bourne Again Shell interpreter; ships with WSL/Git for Windows/Cygwin and executes shell scripts and commands." +cmd.exe,"The native Windows command-line interpreter used to execute batch scripts and commands." +powershell.exe,"Windows PowerShell (v5.1 and earlier) command-line shell and scripting engine, heavily used for administration and living-off-the-land attacks." +powershell_ise.exe,"PowerShell Integrated Scripting Environment; GUI host for writing and running PowerShell scripts." +psexec*.c,"Sysinternals tool for executing processes on remote systems; frequently abused for lateral movement." +psexec*.exe,"Sysinternals tool for executing processes on remote systems; frequently abused for lateral movement." +psexec64.exe,"64-bit build of the Sysinternals PsExec remote execution tool." +pwsh.exe,"PowerShell (Core) 6+ cross-platform command-line shell and scripting engine, successor to powershell.exe." +pwsh.dll,"PowerShell (Core) 6+ cross-platform command-line shell and scripting engine, successor to powershell.exe." +sh.exe,"POSIX-compatible shell interpreter, typically bundled with Git for Windows/WSL/Cygwin, used to run shell scripts." +windowsterminal.exe,"Modern Windows Terminal application host that runs command-line shells (cmd, PowerShell, WSL) in tabs." +wsl.exe,"Windows Subsystem for Linux launcher; runs a Linux distribution/shell and executes Linux binaries or scripts on Windows." +wt.exe,"Windows Terminal executable, invoked via the wt command; launches and hosts terminal shell sessions." diff --git a/lookups/csv/renamed_windows_command_interpreter_binaries.yml b/lookups/csv/renamed_windows_command_interpreter_binaries.yml new file mode 100644 index 0000000000..0e364ef511 --- /dev/null +++ b/lookups/csv/renamed_windows_command_interpreter_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_windows_command_interpreter_binaries +id: 2517d9fc-a1ee-4303-9a5b-15eaee7f418b +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of Windows command interpreter binaries and detailed information regarding their usage +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false From 3115df76912b73f367d295247e4c8dc21f46dcba Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:23:50 +0200 Subject: [PATCH 137/164] version update --- detections/endpoint/wmi_permanent_event_subscription.yml | 2 +- .../endpoint/wmi_permanent_event_subscription___sysmon.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 90cdca1ae4..0455b9c92d 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -1,6 +1,6 @@ name: WMI Permanent Event Subscription id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d -version: 15 +version: 11 creation_date: '2020-04-29' modification_date: '2026-10-05' author: Rico Valdez, Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 9a6f4e32e1..9b6796c2b9 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -1,6 +1,6 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 -version: 14 +version: 13 creation_date: '2020-04-29' modification_date: '2026-10-05' author: Rico Valdez, Michael Haag, Splunk From ec66842b10a7486f7c1488ff35bdcb9f1613b68e Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:47:45 +0200 Subject: [PATCH 138/164] Update wmi_permanent_event_subscription___sysmon.yml --- .../wmi_permanent_event_subscription___sysmon.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 9b6796c2b9..605bf5d24e 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -7,13 +7,17 @@ author: Rico Valdez, Michael Haag, Splunk status: production type: Anomaly description: |- - Detects the creation of a WMI permanent event subscription using Sysmon EventID 21. + Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21. data_source: - Sysmon EventID 21 search: |- `sysmon` EventCode=21 - Operation=Created + Operation IN ( + Created, + Deleted, + Modified + ) | stats count min(_time) as firstTime max(_time) as lastTime From 2e906db303c44feed2f00040a80a8e43e2ef3def Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 15:52:28 +0200 Subject: [PATCH 139/164] Update detections/endpoint/wmi_permanent_event_subscription.yml Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- detections/endpoint/wmi_permanent_event_subscription.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 0455b9c92d..367735a71c 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -7,7 +7,7 @@ author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: Anomaly description: |- - Detects WMI permanent event subscriptions from Windows WMI-Activity EventID 5861. + Detects permanent WMI event subscriptions that are containing `CommandLineEventConsumer` or `ActiveScriptEventConsumer`. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes. data_source: - Windows Event Log WMI Activity 5861 search: |- From 0443d7b68535009c433b6534437d3c89b726f2da Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 19:09:52 +0200 Subject: [PATCH 140/164] Apply codex reviews (#4317) --- .github/workflows/archived-ta-tracker.yml | 2 +- .../endpoint/windows_admin_password_changed_by_non_admin.yml | 2 +- .../endpoint/windows_renamed_lolbas_binary_was_executed.yml | 2 +- scripts/check_archived_tas.py | 2 ++ 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/archived-ta-tracker.yml b/.github/workflows/archived-ta-tracker.yml index 25d202bf6a..0f45898107 100644 --- a/.github/workflows/archived-ta-tracker.yml +++ b/.github/workflows/archived-ta-tracker.yml @@ -22,7 +22,7 @@ jobs: python-version: "3.12" - name: Install YAML parser - run: python -m pip install PyYAML + run: python -m pip install PyYAML==6.0.3 - name: Create or update archived TA issues env: diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml index 3c8a2b17db..1d6ad8ec27 100644 --- a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml +++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml @@ -53,7 +53,7 @@ drilldown_searches: name: View risk events for the last 7 days for - "$dest$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' finding: - title: Non-Administrator account [$src_user$] changed the password of the Admin account [$user$] on $dest$. + title: Non-Administrator account [$src_user$] changed the password of the Admin account [$TargetUserName$] on $dest$. entity: field: dest type: system diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml index f0842c81eb..2569bb5995 100644 --- a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -31,7 +31,7 @@ search: |- | rename original_file_name as Processes.process_name | table Processes.process_name ] - NOT process_name IN ( + NOT Processes.process_name IN ( "excelcnv.exe", "installutil64.exe", "protoc~1.exe", diff --git a/scripts/check_archived_tas.py b/scripts/check_archived_tas.py index 020fa3f2d7..a3b433e070 100644 --- a/scripts/check_archived_tas.py +++ b/scripts/check_archived_tas.py @@ -56,6 +56,8 @@ def discover_used_tas() -> dict[str, dict[str, Any]]: } for path in yaml_files(DETECTIONS_DIR): + if (DETECTIONS_DIR / "deprecated") in path.parents: + continue detection = load_yaml(path) if not detection: continue From ce03ed3086dc4249ffe060a23802853da4a13c2c Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 6 Oct 2026 12:00:23 +0200 Subject: [PATCH 141/164] More Codex Fixes (#4318) --- ...azure_ad_user_consent_blocked_for_risky_application.yml | 2 +- .../windows_renamed_command_interpreter_was_executed.yml | 7 +++---- .../windows_renamed_lolbas_binary_was_executed.yml | 7 +++---- ...ows_renamed_popular_3rd_party_software_was_executed.yml | 7 +++---- 4 files changed, 10 insertions(+), 13 deletions(-) diff --git a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml index 9fc6cc7550..34fb99e3ae 100644 --- a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml @@ -24,7 +24,7 @@ search: |- | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1) | search reason_index >= 0 | eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) - | search reason = "Risky application detected" + | search reason = "\"Risky application detected\"" | rex field=permissions "Scope: (?[^,]+)" | fillnull diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml index 3e97a3ea43..bf7c9666d5 100644 --- a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml +++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml @@ -41,10 +41,9 @@ search: |- | `drop_dm_object_name(Processes)` - | eval original_file_name=lower(original_file_name) - - | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) - | where NOT match(process_name, "(?i)".original_file_name) + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm | lookup local=t renamed_windows_command_interpreter_binaries original_file_name OUTPUT description diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml index 2569bb5995..2d13725422 100644 --- a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -49,10 +49,9 @@ search: |- | `drop_dm_object_name(Processes)` - | eval original_file_name=lower(original_file_name) - - | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) - | where NOT match(process_name, "(?i)".original_file_name) + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm | lookup local=t renamed_lolbas_binaries original_file_name OUTPUT description diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml index 374458d818..5de6fed7b9 100644 --- a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml +++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml @@ -41,10 +41,9 @@ search: |- | `drop_dm_object_name(Processes)` - | eval original_file_name=lower(original_file_name) - - | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) - | where NOT match(process_name, "(?i)".original_file_name) + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm | lookup local=t renamed_popular_3rd_party_binaries original_file_name OUTPUT description From 2dc3668424cad95cc86da387a44e466ff181c190 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 6 Oct 2026 13:21:31 +0200 Subject: [PATCH 142/164] Extra Logic Fixes From Codex (#4319) --- ...ows_ad_spn_unicode_collision_injection.yml | 2 +- ...named_command_interpreter_was_executed.yml | 6 ---- ...ows_renamed_lolbas_binary_was_executed.yml | 7 +--- ...opular_3rd_party_software_was_executed.yml | 6 ---- ...ows_renamed_python_binary_was_executed.yml | 34 +++++++++++++------ 5 files changed, 25 insertions(+), 30 deletions(-) diff --git a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml index bc34b8c481..95de6c73ae 100644 --- a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml +++ b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml @@ -7,7 +7,7 @@ author: Raven Tait, Splunk status: production type: TTP description: |- - The following analytic detects the addition of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. + The following analytic detects the addition or modification of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account's SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner). LDAP's string preparation rules (RFC 4518) cause these characters to be ignored during uniqueness checking, allowing the write to succeed even when an identical SPN already exists on another machine account. The Kerberos KDC, however, does not apply the same normalisation — it finds two accounts with matching SPNs and returns KDC_ERR_S_PRINCIPAL_UNKNOWN, causing a Kerberos denial-of-service or forcing clients to fall back to NTLM downgrade. diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml index bf7c9666d5..1a57af5204 100644 --- a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml +++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml @@ -19,17 +19,11 @@ search: |- FROM datamodel=Endpoint.Processes WHERE - NOT Processes.original_file_name IN ("-","unknown") [ | inputlookup renamed_windows_command_interpreter_binaries | rename original_file_name as Processes.original_file_name | table Processes.original_file_name ] - NOT [ - | inputlookup renamed_windows_command_interpreter_binaries - | rename original_file_name as Processes.process_name - | table Processes.process_name - ] by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml index 2d13725422..2a8a53caf7 100644 --- a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -20,17 +20,12 @@ search: |- FROM datamodel=Endpoint.Processes WHERE - NOT Processes.original_file_name IN ("-","unknown") [ | inputlookup renamed_lolbas_binaries | rename original_file_name as Processes.original_file_name | table Processes.original_file_name ] - NOT [ - | inputlookup renamed_lolbas_binaries - | rename original_file_name as Processes.process_name - | table Processes.process_name - ] + NOT Processes.process_name IN ( "excelcnv.exe", "installutil64.exe", diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml index 5de6fed7b9..640c8aa4ae 100644 --- a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml +++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml @@ -19,17 +19,11 @@ search: |- FROM datamodel=Endpoint.Processes WHERE - NOT Processes.original_file_name IN ("-","unknown") [ | inputlookup renamed_popular_3rd_party_binaries | rename original_file_name as Processes.original_file_name | table Processes.original_file_name ] - NOT [ - | inputlookup renamed_popular_3rd_party_binaries - | rename original_file_name as Processes.process_name - | table Processes.process_name - ] by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id diff --git a/detections/endpoint/windows_renamed_python_binary_was_executed.yml b/detections/endpoint/windows_renamed_python_binary_was_executed.yml index 4f0731c451..e1b2655e8e 100644 --- a/detections/endpoint/windows_renamed_python_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_python_binary_was_executed.yml @@ -14,24 +14,36 @@ data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime - FROM datamodel=Endpoint.Processes - WHERE - Processes.original_file_name IN ( + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.original_file_name IN ( "py*", "python*", "ipyw*" - ) - NOT Processes.original_file_name IN ("-","unknown") - NOT Processes.process_name IN ("dwagent.exe", "WinUtils.exe") - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id - Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + ) + + NOT Processes.process_name IN ("dwagent.exe", "WinUtils.exe") + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | eval original_file_name=lower(original_file_name) + | regex original_file_name="(?i)^(?:py|pyw|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+)\.exe$" + | regex process_name!="(?i)^(?:py|pyw|pip|pip3|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+|pip3\.\w+|idle3\.\w+)\.exe$" + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_renamed_python_binary_was_executed_filter` From c324183503fe293aee96b0e3bd96a4230a92795a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 6 Oct 2026 20:58:11 -0500 Subject: [PATCH 143/164] Decrement version on detection that should not have been bumped because no stanza fields were changed, this detection should not have been bumped. --- ...vm___browser_spawned_unix_shell_with_external_connection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml index 15f820549c..72bbe5d099 100644 --- a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Browser Spawned Unix Shell with External Connection id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 -version: 2 +version: 1 creation_date: '2026-09-02' modification_date: '2026-09-22' author: Maria Jose Erquiaga, Splunk From d339507b4cf7dbd290df265549c9c835f2124ec2 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 6 Oct 2026 21:33:32 -0500 Subject: [PATCH 144/164] another detection that was bumped accidentally --- .../endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 4291c2f1be..62be4e512f 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 -version: 9 +version: 8 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk From 52449e2a8a9f3743e82ea02c3860d962d02010a5 Mon Sep 17 00:00:00 2001 From: Eric McGinnis Date: Tue, 6 Oct 2026 21:54:32 -0500 Subject: [PATCH 145/164] Push changed to a bunch of files that should not have been bumped --- ...m___mshtml_or_mshta_network_execution_without_url_in_cli.yml | 2 +- ...cisco_nvm___non_network_binary_making_network_connection.yml | 2 +- ...o_nvm___osascript_network_connection_for_a_long_duration.yml | 2 +- .../cisco_nvm___rclone_execution_with_network_activity.yml | 2 +- ..._nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml | 2 +- ...m___susp_script_from_archive_triggering_network_activity.yml | 2 +- ...isco_nvm___suspicious_download_from_file_sharing_website.yml | 2 +- ...isco_nvm___suspicious_file_download_via_headless_browser.yml | 2 +- ..._suspicious_network_connection_from_process_with_no_args.yml | 2 +- ..._nvm___suspicious_network_connection_initiated_via_msxsl.yml | 2 +- ...__suspicious_network_connection_to_ip_lookup_service_api.yml | 2 +- ...cisco_nvm___webserver_download_from_file_sharing_website.yml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index e2b0c93aa3..ff2f2a1108 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -1,6 +1,6 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index dc296fbfa2..5d9707b471 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index 1d63ae1c37..f9a7a87931 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Osascript Network Connection for a Long Duration id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 -version: 2 +version: 1 creation_date: '2026-09-18' modification_date: '2026-09-22' author: Radka Viskova, Splunk diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index 002d7f3c79..f08391700b 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index c8caad0967..b64b3f4cbe 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index d98e0f72d8..fe101b8b27 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 2d0f030e05..790d763268 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index 9e5dd3c33f..868531d281 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index f2e4760a56..c3ab060c00 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index e4cc59a7ea..7a99176ded 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index c7c2ad43c3..6586f1d026 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f -version: 9 +version: 8 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index f1360e9e90..e79046f8d0 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk From 5298bf68951862aac12f5a07770c63f8f2ecd4d5 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 7 Oct 2026 19:56:44 +0200 Subject: [PATCH 146/164] Bump contentctl.yml and build.yml to 6.9.0 (#4326) --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index 5a6a252bb0..90e9100bc5 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.8.0 +app_version: 6.9.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index e6c1aceb7c..2669049f6c 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.8.0 + version: 6.9.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 670987f506c251a267de6f4127fe8044359ebc18 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 7 Oct 2026 15:07:34 -0400 Subject: [PATCH 147/164] M365 Copilot detection test description update and promote to production (#4325) --- .../application/m365_copilot_agentic_jailbreak_attack.yml | 6 +++--- .../m365_copilot_impersonation_jailbreak_attack.yml | 6 +++--- ...m365_copilot_information_extraction_jailbreak_attack.yml | 6 +++--- detections/application/m365_copilot_jailbreak_attempts.yml | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/detections/application/m365_copilot_agentic_jailbreak_attack.yml b/detections/application/m365_copilot_agentic_jailbreak_attack.yml index e73d2df500..ba76b389cf 100644 --- a/detections/application/m365_copilot_agentic_jailbreak_attack.yml +++ b/detections/application/m365_copilot_agentic_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Agentic Jailbreak Attack id: e5c7b380-19da-42e9-9e53-0af4cd27aee3 -version: 5 +version: 6 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts. data_source: @@ -62,4 +62,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml index cba621255a..4659c8a4b8 100644 --- a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml +++ b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Impersonation Jailbreak Attack id: cc26aba8-7f4a-4078-b91a-052d6a53cb13 -version: 6 +version: 7 creation_date: '2025-10-13' modification_date: '2026-06-04' author: Rod Soto -status: experimental +status: production type: TTP description: Detects M365 Copilot impersonation and roleplay jailbreak attempts where users try to manipulate the AI into adopting alternate personas, behaving as unrestricted entities, or impersonating malicious AI systems to bypass safety controls. The detection searches exported eDiscovery prompt logs for roleplay keywords like "pretend you are," "act as," "you are now," "amoral," and "roleplay as" in the Subject_Title field. Prompts are categorized into specific impersonation types (AI_Impersonation, Malicious_AI_Persona, Unrestricted_AI_Persona, etc.) to identify attempts to override the AI's safety guardrails through persona injection attacks. data_source: @@ -54,4 +54,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml index 9edff8c36c..b856ed8822 100644 --- a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml +++ b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Information Extraction Jailbreak Attack id: c0ee37bb-ed43-4632-8e38-060fba80b0b2 -version: 5 +version: 6 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: TTP description: Detects M365 Copilot information extraction jailbreak attacks that attempt to obtain sensitive, classified, or comprehensive data through various social engineering techniques including fictional entity impersonation, bulk data requests, and privacy bypass attempts. The detection searches exported eDiscovery prompt logs for extraction keywords like "transcendent," "tell me everything," "confidential," "dump," "extract," "reveal," and "bypass" in the Subject_Title field, categorizing each attempt by extraction type and assigning severity levels (CRITICAL for classified/proprietary data, HIGH for bulk extraction or privacy bypass). Prompts are further analyzed for compound risk patterns such as "Confidential+Extraction" or "Bulk_Request+Bypass," filtering out low-severity cases to surface the most dangerous attempts to exfiltrate sensitive organizational information through AI manipulation. data_source: @@ -93,4 +93,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_jailbreak_attempts.yml b/detections/application/m365_copilot_jailbreak_attempts.yml index 28c8410f74..ca4445a565 100644 --- a/detections/application/m365_copilot_jailbreak_attempts.yml +++ b/detections/application/m365_copilot_jailbreak_attempts.yml @@ -1,10 +1,10 @@ name: M365 Copilot Jailbreak Attempts id: b05a4f25-e07d-436f-ab03-f954afa922c0 -version: 6 +version: 7 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=," "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption. data_source: @@ -67,4 +67,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. From 87428989de7b9f645bbae05783c6fb05500d9c3e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 8 Oct 2026 12:13:04 +0200 Subject: [PATCH 148/164] Automated NIST AI RMF detection map update 35 (#4327) --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- .github/workflows/update_nist_ai_rmf_detection_map.yml | 2 +- lookups/csv/detection_subcategory_map.csv | 8 ++++---- lookups/csv/detection_subcategory_map.yml | 6 +++--- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/update_nist_ai_rmf_detection_map.yml b/.github/workflows/update_nist_ai_rmf_detection_map.yml index 7d832fed6e..1d362f4878 100644 --- a/.github/workflows/update_nist_ai_rmf_detection_map.yml +++ b/.github/workflows/update_nist_ai_rmf_detection_map.yml @@ -43,7 +43,7 @@ jobs: commit-message: Update NIST AI RMF detection map branch: auto-nist-ai-rmf-detection-map-${{ github.run_number }} base: develop - title: Automated NIST AI RMF detection map update ${{ github.run_number }} + title: Automated NIST AI RMF lookup table update body: | This PR updates the generated NIST AI RMF detection-to-subcategory lookup. diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv index 391d63fab3..5a4b938343 100644 --- a/lookups/csv/detection_subcategory_map.csv +++ b/lookups/csv/detection_subcategory_map.csv @@ -14,10 +14,10 @@ M365 Copilot,M365 Copilot Graph API,M365 Copilot Application Usage Pattern Anoma M365 Copilot,M365 Copilot Graph API,M365 Copilot Failed Authentication Patterns,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal M365 Copilot,M365 Copilot Graph API,M365 Copilot Non Compliant Devices Accessing M365 Copilot,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,GOVERN,Govern 1.6,high,generated_rule,AI system or access inventory signal M365 Copilot,M365 Copilot Graph API,M365 Copilot Session Origin Anomalies,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Agentic Jailbreak Attack,experimental,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Impersonation Jailbreak Attack,experimental,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Information Extraction Jailbreak Attack,experimental,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7|Measure 2.10,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal; Sensitive information or data-protection signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Jailbreak Attempts,experimental,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Agentic Jailbreak Attack,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Impersonation Jailbreak Attack,production,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Information Extraction Jailbreak Attack,production,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7|Measure 2.10,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal; Sensitive information or data-protection signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Jailbreak Attempts,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal MCP,MCP Server,MCP Filesystem Server Suspicious Extension Write,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal MCP,MCP Server,MCP Github Suspicious Operation,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal MCP,MCP Server,MCP Postgres Suspicious Query,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml index b98d706b65..01c7b156b9 100644 --- a/lookups/csv/detection_subcategory_map.yml +++ b/lookups/csv/detection_subcategory_map.yml @@ -1,8 +1,8 @@ name: detection_subcategory_map id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 -version: 2 +version: 3 creation_date: '2026-09-02' -modification_date: '2026-09-02' +modification_date: '2026-10-08' author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team lookup_type: csv -description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. Regenerate with scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py when AI data sources or detections change. +description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. From 2e47a6e36398c4c9e5f6b5d936cf89602cbd9bd1 Mon Sep 17 00:00:00 2001 From: p4t12ick Date: Thu, 8 Oct 2026 15:08:28 +0200 Subject: [PATCH 149/164] Bug Fix for Issue #4293 (#4324) --------- Co-authored-by: Nasreddine Bencherchali --- ...etect_new_open_s3_buckets_over_aws_cli.yml | 95 +++++++++++++++---- 1 file changed, 77 insertions(+), 18 deletions(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 55cad13073..6f54d9dce3 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -1,29 +1,85 @@ name: Detect New Open S3 Buckets over AWS CLI id: 39c61d09-8b30-4154-922b-2d0a694ecc22 -version: 10 +version: 11 creation_date: '2021-01-12' modification_date: '2026-05-13' -author: Patrick Bareiss, Splunk +author: Patrick Bareiss, Splunk, vshcherbakov status: production type: TTP -description: The following analytic detects the creation of open/public S3 buckets via the AWS CLI. It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches. If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk. +description: |- + The following analytic detects the creation of open/public S3 buckets via the AWS CLI. + It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches. + If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk. data_source: - AWS CloudTrail search: |- - `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") - | rename requestParameters.bucketName AS bucketName - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY userIdentity.userName userIdentity.principalId userAgent - bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp - requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control - | rename userIdentity.userName as user - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_new_open_s3_buckets_over_aws_cli_filter` -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -references: [] + `cloudtrail` + eventSource="s3.amazonaws.com" + eventName="PutBucketAcl" + errorCode=success + userAgent IN ("[aws-cli*", "aws-cli*") + + | rename requestParameters.bucketName AS bucketName + requestParameters.accessControlList.x-amz-grant-read AS grantRead + requestParameters.accessControlList.x-amz-grant-read-acp AS grantReadAcp + requestParameters.accessControlList.x-amz-grant-write AS grantWrite + requestParameters.accessControlList.x-amz-grant-write-acp AS grantWriteAcp + requestParameters.accessControlList.x-amz-grant-full-control AS grantFullControl + requestParameters.x-amz-acl AS cannedAcl, + userIdentity.principalId AS principalId + userIdentity.userName AS userName + userIdentity.arn AS userArn + + | eval grantRead=coalesce(grantRead,"-"), + grantReadAcp=coalesce(grantReadAcp,"-"), + grantWrite=coalesce(grantWrite,"-"), + grantWriteAcp=coalesce(grantWriteAcp,"-"), + grantFullControl=coalesce(grantFullControl,"-"), + cannedAcl=coalesce(cannedAcl,"-"), + user=coalesce(userName,userArn) + + | eval publicGrant = if( + match(grantRead, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantReadAcp, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantWrite, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantWriteAcp, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantFullControl, "(?i)AllUsers|AuthenticatedUsers"), + 1, + 0 + ) + + | eval publicCanned = if(cannedAcl IN ("public-read", "public-read-write", "authenticated-read"), 1, 0) + + | where publicGrant=1 OR publicCanned=1 + + | eval exposure=case(cannedAcl=="public-read-write","public-write", match(grantWrite."".grantWriteAcp."".grantFullControl,"(?i)AllUsers"),"public-write", cannedAcl=="public-read" OR match(grantRead,"(?i)AllUsers"),"public-read", cannedAcl=="authenticated-read" OR match(grantRead,"(?i)AuthenticatedUsers"),"authenticated-read", true(),"custom-grant") + + | stats count + min(_time) AS firstTime + max(_time) AS lastTime + values(cannedAcl) AS cannedAcl + values(grantRead) AS grantRead + values(grantReadAcp) AS grantReadAcp + values(grantWrite) AS grantWrite + values(grantWriteAcp) AS grantWriteAcp + values(grantFullControl) AS grantFullControl + values(eventName) AS eventName + + BY user principalId userAgent bucketName exposure + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_new_open_s3_buckets_over_aws_cli_filter` +how_to_implement: |- + The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: |- + It is possible that an AWS admin has legitimately created a public bucket for a specific purpose. AWS strongly advises against granting full control to the "All Users" group. Investigate and apply the necessary filters as needed. +references: + - https://docs.aws.amazon.com/cli/latest/reference/s3api/create-bucket.html drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' @@ -34,11 +90,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ + title: User [$user$] has created an open/public S3 Bucket [$bucketName$] using AWS CLI with the following permissions - [$grantRead$] [$grantReadAcp$] [$grantWrite$] [$grantWriteAcp$] [$grantFullControl$] [$cannedAcl$] entity: field: user type: user score: 50 +threat_objects: + - field: bucketName + type: bucket_name analytic_story: - Suspicious AWS S3 Activities asset_type: S3 Bucket From dd8c9a3cb77fbe2179e6bcac08e1303dc61733ec Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 9 Oct 2026 11:40:48 +0200 Subject: [PATCH 150/164] Remove `CrowdStrike ProcessRollup2` Reference from Content Using `parent_process` (#4316) --- detections/endpoint/jscript_execution_using_cscript_app.yml | 5 ++--- detections/endpoint/ping_sleep_batch_command.yml | 5 ++--- .../endpoint/possible_lateral_movement_powershell_spawn.yml | 5 ++--- .../endpoint/svchost_lolbas_execution_process_spawn.yml | 5 ++--- .../endpoint/vbscript_execution_using_wscript_app.yml | 5 ++--- .../windows_command_shell_dcrat_forkbomb_payload.yml | 5 ++--- ...ws_for_loop_usage_within_cmd_exe_to_execute_commands.yml | 5 ++--- .../windows_indirect_command_execution_via_forfiles.yml | 5 ++--- .../windows_indirect_command_execution_via_pcalua.yml | 5 ++--- ...indows_proxy_execution_of__net_utilities_via_scripts.yml | 6 ++---- .../windows_scheduled_task_service_spawned_shell.yml | 5 ++--- detections/endpoint/windows_ssh_proxy_command.yml | 5 ++--- .../windows_suspicious_react_or_next_js_child_process.yml | 5 ++--- detections/endpoint/windows_time_based_evasion.yml | 5 ++--- 14 files changed, 28 insertions(+), 43 deletions(-) diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 4082fc5412..198f9016e6 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -1,8 +1,8 @@ name: Jscript Execution Using Cscript App id: 002f1e24-146e-11ec-a470-acde48001122 -version: 14 +version: 15 creation_date: '2021-09-14' -modification_date: '2026-08-31' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -13,7 +13,6 @@ description: |- If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index b34b2835a4..2283e1a9af 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -1,8 +1,8 @@ name: Ping Sleep Batch Command id: ce058d6c-79f2-11ec-b476-acde48001122 -version: 17 +version: 18 creation_date: '2022-01-20' -modification_date: '2026-08-11' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,7 +14,6 @@ description: |- Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 8fe0edf7a6..6b73129ed4 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -1,8 +1,8 @@ name: Possible Lateral Movement PowerShell Spawn id: cb909b3e-512b-11ec-aa31-3e22fbd008af -version: 17 +version: 18 creation_date: '2021-11-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Mauricio Velazco, Michael Haag, Splunk status: production type: Anomaly @@ -13,7 +13,6 @@ description: | If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index 2d1937a88b..d0ab2e9869 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -1,8 +1,8 @@ name: Svchost LOLBAS Execution Process Spawn id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 15 +version: 16 creation_date: '2021-11-23' -modification_date: '2026-07-27' +modification_date: '2026-10-09' author: Mauricio Velazco, Splunk status: production type: TTP @@ -11,7 +11,6 @@ description: |- If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 7ae808c2c9..628db71437 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -1,15 +1,14 @@ name: Vbscript Execution Using Wscript App id: 35159940-228f-11ec-8a49-acde48001122 -version: 13 +version: 14 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of VBScript using the wscript.exe application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because wscript.exe is typically not used to execute VBScript, which is usually associated with cscript.exe. This deviation can indicate an attempt to evade traditional process monitoring and antivirus defenses. If confirmed malicious, this technique could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ( diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index 8ad38fc09d..f9e7d6f0af 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -1,15 +1,14 @@ name: Windows Command Shell DCRat ForkBomb Payload id: 2bb1a362-7aa8-444a-92ed-1987e8da83e1 -version: 14 +version: 15 creation_date: '2022-07-28' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of a DCRat "forkbomb" payload, which spawns multiple cmd.exe processes that launch notepad.exe instances in quick succession. This detection leverages Endpoint Detection and Response (EDR) data, focusing on the rapid creation of cmd.exe and notepad.exe processes within a 30-second window. This activity is significant as it indicates a potential DCRat infection, a known Remote Access Trojan (RAT) with destructive capabilities. If confirmed malicious, this behavior could lead to system instability, resource exhaustion, and potential disruption of services. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` values(Processes.user) as user values(Processes.action) as action values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product dc(Processes.parent_process_id) as parent_process_id_count dc(Processes.process_id) as process_id_count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process_name= "cmd.exe" (Processes.process_name = "notepad.exe" diff --git a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml index a4e9eadf4a..f3dc13d6c8 100644 --- a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml +++ b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml @@ -1,8 +1,8 @@ name: Windows For Loop Usage Within Cmd.exe To Execute Commands id: a4ce9079-fc8f-4749-982a-13197c8cf977 -version: 1 +version: 2 creation_date: '2026-09-16' -modification_date: '2026-09-16' +modification_date: '2026-10-09' author: Onur Mustafa Erdogan, Splunk status: production type: Anomaly @@ -11,7 +11,6 @@ description: |- Adversaries and malicious scripts leverage this pattern to programmatically process command output for discovery, data extraction, or execution purposes while evading simpler detection logic. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index 2a70eea3f6..de6a411fc9 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -1,15 +1,14 @@ name: Windows Indirect Command Execution Via forfiles id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787 -version: 11 +version: 12 creation_date: '2022-03-04' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Eric McGinnis, Splunk status: production type: TTP description: The following analytic detects the execution of programs initiated by forfiles.exe. This command is typically used to run commands on multiple files, often within batch scripts. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where forfiles.exe is the parent process. This activity is significant because forfiles.exe can be exploited to bypass command line execution protections, making it a potential vector for malicious activity. If confirmed malicious, this could allow attackers to execute arbitrary commands, potentially leading to unauthorized access or further system compromise. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process="*forfiles* /c *" diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index f5060aafe3..296099e1af 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -1,15 +1,14 @@ name: Windows Indirect Command Execution Via pcalua id: 3428ac18-a410-4823-816c-ce697d26f7a8 -version: 11 +version: 12 creation_date: '2022-03-04' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Eric McGinnis, Splunk status: production type: TTP description: The following analytic detects programs initiated by pcalua.exe, the Microsoft Windows Program Compatibility Assistant. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process information. While pcalua.exe can start legitimate programs, it is significant because attackers may use it to bypass command line execution protections. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, potentially leading to unauthorized actions, privilege escalation, or persistence within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process="*pcalua* -a*" diff --git a/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml b/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml index 96aadbd743..c8fcafe4e2 100644 --- a/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml +++ b/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml @@ -1,8 +1,8 @@ name: Windows Proxy Execution of .NET Utilities via Scripts id: eb59cf01-1874-4d16-b7e4-54a6eb9b3118 -version: 2 +version: 3 creation_date: '2026-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -11,8 +11,6 @@ description: |- That pattern is consistent with adversaries using trusted .NET binaries as a proxy to run code while hiding execution behind script parents in low-trust folders, behavior associated with techniques such as signed binary proxy execution. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml index 3694b15b21..2da9f7d103 100644 --- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task Service Spawned Shell id: d8120352-3b62-4e3c-8cb6-7b47584dd5e8 -version: 12 +version: 13 creation_date: '2023-07-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Steven Dick status: production type: TTP @@ -13,7 +13,6 @@ description: | If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, or escalate privileges within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_ssh_proxy_command.yml b/detections/endpoint/windows_ssh_proxy_command.yml index d8d2fc28bf..02812d7a62 100644 --- a/detections/endpoint/windows_ssh_proxy_command.yml +++ b/detections/endpoint/windows_ssh_proxy_command.yml @@ -1,8 +1,8 @@ name: Windows SSH Proxy Command id: ac520039-21f1-4567-b528-5b7133dba76f -version: 6 +version: 7 creation_date: '2025-03-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, AJ King, Nasreddine Bencherchali, Splunk, Jesse Hunter, Splunk Community Contributor status: production type: Anomaly @@ -12,7 +12,6 @@ description: | This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml b/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml index 7719a175db..667888e72b 100644 --- a/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml +++ b/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml @@ -1,8 +1,8 @@ name: Windows Suspicious React or Next.js Child Process id: baa80bc8-7c9c-4395-b458-b69feb92830a -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -13,7 +13,6 @@ description: | Such activity might be a strong indicator of exploitation of the aforementioned vulnerability. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: | | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index 8356037e58..f8cfd97a98 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -1,8 +1,8 @@ name: Windows Time Based Evasion id: 34502357-deb1-499a-8261-ffe144abf561 -version: 14 +version: 15 creation_date: '2023-09-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP @@ -13,7 +13,6 @@ description: |- If confirmed malicious, this activity could indicate an active infection attempting to evade detection, potentially leading to further compromise and persistence within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime From d84e86d7e2796c5f06c1373c6e9e532d1620dd78 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 9 Oct 2026 13:16:10 +0200 Subject: [PATCH 151/164] Fix #4275 (#4330) --- detections/endpoint/windows_ngrok_reverse_proxy_usage.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml index 02f70368d5..0f8ad3b931 100644 --- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml @@ -1,8 +1,8 @@ name: Windows Ngrok Reverse Proxy Usage id: e2549f2c-0aef-408a-b0c1-e0f270623436 -version: 13 +version: 14 creation_date: '2022-11-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -13,7 +13,7 @@ data_source: - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*http*", "*tcp*") + WHERE Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*tcp*") BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path From 1b2142fdd2d1358b4ac6ad3dfc47e5e455e619e8 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 9 Oct 2026 17:45:29 +0200 Subject: [PATCH 152/164] Fix Data Sources with Links to Archived TAs (#4307) --- contentctl.yml | 8 ++++---- data_sources/cisco_ios_logs.yml | 12 ++++++------ .../circle_ci_disable_security_job.yml | 10 +++++++--- .../circle_ci_disable_security_step.yml | 10 +++++++--- macros/{ => deprecated}/circleci.yml | 0 scripts/check_archived_tas.py | 2 ++ 6 files changed, 26 insertions(+), 16 deletions(-) rename detections/{cloud => deprecated}/circle_ci_disable_security_job.yml (92%) rename detections/{cloud => deprecated}/circle_ci_disable_security_step.yml (91%) rename macros/{ => deprecated}/circleci.yml (100%) diff --git a/contentctl.yml b/contentctl.yml index 2669049f6c..1d6537fc16 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -241,10 +241,10 @@ apps: version: 4.0.3 hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-vmware-indexes_403.tgz - uid: 1467 - title: Cisco Networks Add-on - appid: TA-cisco_ios - version: 2.7.9 - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/add-on-for-cisco-network-data_279.tgz + title: Cisco Enterprise Networking Add-on for Splunk + appid: TA-cisco-enterprise-networking-add-on-for-splunk + version: 4.0.35 + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-enterprise-networking-add-on-for-splunk_4035.tgz - uid: 8024 title: TA-ollama appid: ta-ollama diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index bf6b6c5e82..d8d10d3b7e 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -1,17 +1,17 @@ name: Cisco IOS Logs id: 9e4c8d7b-6f5e-4a3d-b2c1-0a9b8c7d6e5f -version: 2 +version: 3 creation_date: '2025-08-21' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Michael Haag, Splunk -description: Data source object for Cisco IOS system logs. Cisco IOS logs provide operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes these events by setting proper sourcetypes and extracting fields for switches, routers, controllers, and access points; deploy the TA on indexers/HFs and search heads, and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This data is ingested via SYSLOG. +description: Data source object for Cisco IOS system logs. source: cisco:ios sourcetype: cisco:ios separator: supported_TA: - - name: Cisco Networks Add-on - url: https://splunkbase.splunk.com/app/1467 - version: 2.8.2 + - name: Cisco Enterprise Networking Add-on for Splunk + url: https://splunkbase.splunk.com/app/7538 + version: 4.0.35 fields: - _time - aci_message_text diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/deprecated/circle_ci_disable_security_job.yml similarity index 92% rename from detections/cloud/circle_ci_disable_security_job.yml rename to detections/deprecated/circle_ci_disable_security_job.yml index 22d5f05039..b93cd1860a 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/deprecated/circle_ci_disable_security_job.yml @@ -1,10 +1,10 @@ name: Circle CI Disable Security Job id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 -version: 11 +version: 12 creation_date: '2021-09-02' -modification_date: '2026-09-22' +modification_date: '2026-10-01' author: Patrick Bareiss, Splunk -status: production +status: deprecated type: Anomaly description: The following analytic detects the disabling of security jobs in CircleCI pipelines. It leverages CircleCI log data, renaming and extracting fields such as job names, workflow IDs, user information, commit messages, URLs, and branches. The detection identifies mandatory jobs for each workflow and checks if they were executed. This activity is significant because disabling security jobs can allow malicious code to bypass security checks, leading to potential data breaches, system downtime, and reputational damage. If confirmed malicious, this could result in unauthorized code execution and compromised pipeline integrity. data_source: @@ -60,3 +60,7 @@ tests: sourcetype: circleci source: circleci test_type: unit +deprecation_info: + reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/deprecated/circle_ci_disable_security_step.yml similarity index 91% rename from detections/cloud/circle_ci_disable_security_step.yml rename to detections/deprecated/circle_ci_disable_security_step.yml index 9f5d5ce02e..5b234e57c1 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/deprecated/circle_ci_disable_security_step.yml @@ -1,10 +1,10 @@ name: Circle CI Disable Security Step id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97 -version: 9 +version: 10 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Patrick Bareiss, Splunk -status: experimental +status: deprecated type: Anomaly description: The following analytic detects the disablement of security steps in a CircleCI pipeline. It leverages CircleCI logs, using field renaming, joining, and statistical analysis to identify instances where mandatory security steps are not executed. This activity is significant because disabling security steps can introduce vulnerabilities, unauthorized changes, or malicious code into the pipeline. If confirmed malicious, this could lead to potential attacks, data breaches, or compromised infrastructure. Investigate by reviewing job names, commit details, and user information associated with the disablement, and examine any relevant artifacts and concurrent processes. data_source: @@ -58,3 +58,7 @@ tests: source: circleci test_type: experimental description: This test is a legacy experimental test and may not be accurate. +deprecation_info: + reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/macros/circleci.yml b/macros/deprecated/circleci.yml similarity index 100% rename from macros/circleci.yml rename to macros/deprecated/circleci.yml diff --git a/scripts/check_archived_tas.py b/scripts/check_archived_tas.py index a3b433e070..27269974dd 100644 --- a/scripts/check_archived_tas.py +++ b/scripts/check_archived_tas.py @@ -61,6 +61,8 @@ def discover_used_tas() -> dict[str, dict[str, Any]]: detection = load_yaml(path) if not detection: continue + if str(detection.get("status") or "").strip().casefold() == "deprecated": + continue references = detection.get("data_source") or [] if isinstance(references, str): references = [references] From e2275d40f9c12302e04479c845d30efcffbe3cb9 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 12 Oct 2026 03:45:51 -0500 Subject: [PATCH 153/164] Update data source TA and install.yml app versions (#4335) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/cisco_ios_logs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index d8d10d3b7e..31ab89661c 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Enterprise Networking Add-on for Splunk url: https://splunkbase.splunk.com/app/7538 - version: 4.0.35 + version: 4.0.50 fields: - _time - aci_message_text From c653da7c11fc74a5410646c96cb05b8998fd6d44 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 12 Oct 2026 15:04:44 +0200 Subject: [PATCH 154/164] Add Atomic GUID Mappings - Batch 1 (#4315) --- .../detect_html_help_spawn_child_process.yml | 5 +++- .../access_lsass_memory_for_dump_creation.yml | 5 +++- .../adsisearcher_account_discovery.yml | 5 +++- .../bcdedit_failure_recovery_modification.yml | 5 +++- detections/endpoint/bits_job_persistence.yml | 5 +++- .../endpoint/bitsadmin_download_file.yml | 5 +++- .../certutil_with_decode_argument.yml | 5 +++- ...t___curl_execution_with_insecure_flags.yml | 3 ++- ..._loading_from_world_writable_directory.yml | 5 +++- ...or_delete_windows_shares_using_net_exe.yml | 7 +++++- .../creation_of_lsass_dump_with_taskmgr.yml | 5 +++- .../endpoint/creation_of_shadow_copy.yml | 7 +++++- ...f_shadow_copy_with_wmic_and_powershell.yml | 7 +++++- ...ping_via_copy_command_from_shadow_copy.yml | 5 +++- ...ial_dumping_via_symlink_to_shadow_copy.yml | 5 +++- .../delete_shadowcopy_with_powershell.yml | 5 +++- .../endpoint/deleting_shadow_copies.yml | 5 +++- ...redential_dumping_through_lsass_access.yml | 5 +++- .../detect_html_help_url_in_command_line.yml | 5 +++- ...l_help_using_infotech_storage_handlers.yml | 5 +++- .../detect_mshta_inline_hta_execution.yml | 9 ++++++- .../detect_mshta_url_in_command_line.yml | 5 +++- .../detect_new_local_admin_account.yml | 7 ++++-- ...nterception_by_creation_of_program_exe.yml | 5 +++- .../detect_psexec_with_accepteula_flag.yml | 5 +++- ...ct_regsvr32_application_control_bypass.yml | 5 +++- ...t_remote_access_software_usage_process.yml | 25 ++++++++++++++++++- .../detect_rundll32_inline_hta_execution.yml | 7 +++++- ...tect_sharphound_command_line_arguments.yml | 5 +++- .../detect_sharphound_file_modifications.yml | 5 +++- .../endpoint/detect_sharphound_usage.yml | 5 +++- .../endpoint/disable_etw_through_registry.yml | 7 +++++- .../endpoint/disable_logs_using_wevtutil.yml | 5 +++- detections/endpoint/disable_registry_tool.yml | 5 +++- .../disable_windows_behavior_monitoring.yml | 5 +++- .../endpoint/disabling_cmd_application.yml | 5 +++- .../disabling_remote_user_account_control.yml | 7 ++++-- .../disabling_systemrestore_in_registry.yml | 5 +++- ...main_group_discovery_with_adsisearcher.yml | 5 +++- .../endpoint/dsquery_domain_discovery.yml | 5 +++- .../endpoint/dump_lsass_via_comsvcs_dll.yml | 5 +++- .../endpoint/dump_lsass_via_procdump.yml | 5 +++- ...le_wdigest_uselogoncredential_registry.yml | 7 +++++- detections/endpoint/esentutl_sam_copy.yml | 5 +++- detections/endpoint/eventvwr_uac_bypass.yml | 7 +++++- detections/endpoint/fodhelper_uac_bypass.yml | 7 +++++- ...ltdomainpasswordpolicy_with_powershell.yml | 5 +++- .../endpoint/get_aduser_with_powershell.yml | 5 +++- ...et_aduser_with_powershell_script_block.yml | 5 +++- .../get_domainpolicy_with_powershell.yml | 5 +++- .../get_domaintrust_with_powershell.yml | 5 +++- .../get_domainuser_with_powershell.yml | 5 +++- .../get_foresttrust_with_powershell.yml | 5 +++- .../get_wmiobject_group_discovery.yml | 5 +++- ...up_discovery_with_script_block_logging.yml | 5 +++- ...dcomputer_with_powershell_script_block.yml | 5 +++- .../endpoint/getadgroup_with_powershell.yml | 5 +++- ...etadgroup_with_powershell_script_block.yml | 5 +++- .../getcurrent_user_with_powershell.yml | 5 +++- ...rent_user_with_powershell_script_block.yml | 5 +++- .../getdomaincontroller_with_powershell.yml | 5 +++- .../getdomaingroup_with_powershell.yml | 5 +++- ...maingroup_with_powershell_script_block.yml | 5 +++- .../endpoint/getlocaluser_with_powershell.yml | 5 +++- ...twmiobject_ds_computer_with_powershell.yml | 5 +++- ..._files_and_directories_with_attrib_exe.yml | 7 ++++-- ...ovement_wmiexec_commandline_parameters.yml | 5 +++- ...asting_spn_request_with_rc4_encryption.yml | 7 +++++- .../endpoint/linux_add_user_account.yml | 5 +++- .../linux_at_application_execution.yml | 5 ++-- .../linux_auditd_add_user_account.yml | 5 +++- .../linux_auditd_clipboard_data_copy.yml | 5 +++- .../linux_auditd_dd_file_overwrite.yml | 5 +++- ...ux_auditd_file_and_directory_discovery.yml | 5 +++- ...ert_kernel_module_using_insmod_utility.yml | 5 +++- ...td_possible_access_to_credential_files.yml | 5 +++- .../endpoint/linux_auditd_stop_services.yml | 5 +++- ...system_network_configuration_discovery.yml | 5 +++- .../linux_auditd_whoami_user_discovery.yml | 5 +++- .../endpoint/linux_clipboard_data_copy.yml | 5 +++- .../endpoint/linux_curl_upload_file.yml | 5 +++- .../endpoint/linux_dd_file_overwrite.yml | 5 +++- .../endpoint/linux_decode_base64_to_shell.yml | 5 +++- .../linux_docker_root_directory_mount.yml | 5 +++- .../linux_ingress_tool_transfer_hunting.yml | 5 +++- .../linux_ingress_tool_transfer_with_curl.yml | 5 +++- ...ert_kernel_module_using_insmod_utility.yml | 5 +++- .../linux_kernel_module_enumeration.yml | 5 +++- .../endpoint/linux_magic_sysrq_key_abuse.yml | 7 +++++- ...ted_files_or_information_base64_decode.yml | 5 +++- ...linux_ssh_authorized_keys_modification.yml | 5 +++- .../linux_system_network_discovery.yml | 5 +++- ...x_system_reboot_via_system_request_key.yml | 5 +++- .../endpoint/macos_gatekeeper_bypass.yml | 5 +++- .../endpoint/macos_keychains_dumped.yml | 5 +++- .../endpoint/macos_list_firewall_rules.yml | 5 +++- .../macos_network_share_discovery.yml | 5 +++- ...ript_displaying_suspicious_user_prompt.yml | 7 +++++- ...s_powershell_process___encoded_command.yml | 5 +++- ...nitor_registry_keys_for_print_monitors.yml | 7 ++++-- ...etwork_share_discovery_via_dir_command.yml | 3 ++- .../nltest_domain_trust_discovery.yml | 5 +++- detections/endpoint/ntdsutil_export_ntds.yml | 5 +++- .../overwriting_accessibility_binaries.yml | 17 +++++++++++-- ..._hijacking_inprocserver32_modification.yml | 5 +++- ...powershell_disable_security_monitoring.yml | 5 +++- .../powershell_enable_powershell_remoting.yml | 5 +++- .../powershell_execute_com_object.yml | 5 +++- .../powershell_get_localgroup_discovery.yml | 5 +++- ...up_discovery_with_script_block_logging.yml | 5 +++- ...powershell_invoke_cimmethod_cimsession.yml | 5 +++- .../powershell_start_bitstransfer.yml | 5 +++- .../powershell_start_or_stop_service.yml | 5 +++- .../endpoint/process_execution_via_wmi.yml | 7 ++++-- ...istry_keys_for_creating_shim_databases.yml | 7 ++++-- .../registry_keys_used_for_persistence.yml | 7 ++++-- ...try_keys_used_for_privilege_escalation.yml | 9 ++++++- ...2_silent_and_install_param_dll_loading.yml | 5 +++- .../remote_process_instantiation_via_wmi.yml | 5 +++- ...ote_system_discovery_with_adsisearcher.yml | 5 +++- .../endpoint/remote_wmi_command_attempt.yml | 5 +++- .../endpoint/resize_shadowstorage_volume.yml | 5 +++- .../endpoint/rundll32_control_rundll_hunt.yml | 5 +++- .../rundll_loading_dll_by_ordinal.yml | 5 +++- ...eduled_task_deleted_or_created_via_cmd.yml | 5 +++- ...led_task_initiation_on_remote_endpoint.yml | 5 +++- ...htasks_scheduling_job_on_remote_system.yml | 7 ++++-- ...ceprincipalnames_discovery_with_setspn.yml | 5 +++- .../endpoint/shim_database_file_creation.yml | 7 ++++-- ...nstallation_with_suspicious_parameters.yml | 7 ++++-- .../endpoint/short_lived_windows_accounts.yml | 7 +++++- ...ation_certificates_behavior_identified.yml | 5 +++- ...ious_microsoft_workflow_compiler_usage.yml | 5 +++- .../suspicious_mshta_child_process.yml | 7 +++++- .../endpoint/suspicious_reg_exe_process.yml | 5 +++- .../endpoint/suspicious_rundll32_startw.yml | 5 +++- .../endpoint/suspicious_wevtutil_usage.yml | 5 +++- ...system_information_discovery_detection.yml | 9 ++++++- ...rocesses_run_from_unexpected_locations.yml | 5 +++- .../system_user_discovery_with_query.yml | 7 +++++- .../endpoint/unload_sysmon_filter_driver.yml | 5 +++- ...ser_discovery_with_env_vars_powershell.yml | 5 +++- ..._with_env_vars_powershell_script_block.yml | 5 +++- detections/endpoint/usn_journal_deletion.yml | 5 +++- .../wbadmin_delete_system_backups.yml | 5 +++- ...ss_token_manipulation_sedebugprivilege.yml | 5 +++- .../windows_ad_dsrm_password_reset.yml | 5 +++- detections/endpoint/windows_adfind_exe.yml | 8 +++++- ...itelisting_bypass_attempt_via_rundll32.yml | 11 +++++++- ...ndows_attempt_to_stop_security_service.yml | 5 +++- ...ion_lsass_driver_registry_modification.yml | 5 +++- ...roxy_execution_mavinject_dll_injection.yml | 5 +++- ...ows_cabinet_file_extraction_via_expand.yml | 5 +++- ...ckdoor_execution_via_powershell_script.yml | 5 +++- .../endpoint/windows_create_local_account.yml | 7 +++++- ...te_local_administrator_account_via_net.yml | 7 ++++-- ...ential_dumping_lsass_memory_createdump.yml | 5 +++- ...ndows_curl_download_to_suspicious_path.yml | 5 +++- ...dows_curl_upload_to_remote_destination.yml | 5 +++- ...sable_change_password_through_registry.yml | 5 +++- ...k_workstation_feature_through_registry.yml | 5 +++- ...disable_logoff_button_through_registry.yml | 5 +++- .../windows_disable_notification_center.yml | 5 +++- ...sable_shutdown_button_through_registry.yml | 5 +++- ...ows_event_logging_disable_http_logging.yml | 5 +++- ...group_policy_features_through_registry.yml | 17 ++++++++++++- .../windows_disableantispyware_registry.yml | 7 +++++- .../endpoint/windows_dism_remove_defender.yml | 5 +++- ...earch_order_hijacking_hunt_with_sysmon.yml | 5 +++- ...ows_dotnet_binary_in_non_standard_path.yml | 5 +++- ...ws_entra_user_management_via_azure_cli.yml | 5 +++- ...dows_esx_admins_group_creation_via_net.yml | 5 +++- .../endpoint/windows_event_log_cleared.yml | 5 +++- ...ows_event_logging_service_has_shutdown.yml | 7 +++++- ...image_file_execution_options_injection.yml | 5 +++- .../windows_eventlog_cleared_via_wevtutil.yml | 5 +++- .../endpoint/windows_export_certificate.yml | 5 +++- .../windows_file_download_via_certutil.yml | 7 +++++- .../windows_file_download_via_powershell.yml | 5 +++- ...ws_file_share_discovery_with_powerview.yml | 5 +++- ..._access_rights_modification_via_icacls.yml | 5 ++-- ..._exe_execution_from_windowsapps_folder.yml | 5 +++- .../windows_group_discovery_via_net.yml | 5 +++- ...dows_guest_account_enabled_via_net_exe.yml | 6 ++++- ...ttp_network_communication_from_msiexec.yml | 5 +++- .../windows_identify_protocol_handlers.yml | 5 +++- .../windows_iis_components_add_new_module.yml | 5 +++- ...indows_iis_components_new_module_added.yml | 5 +++- ...r_defenses_disable_auto_logger_session.yml | 5 +++- .../windows_impair_defenses_disable_hvci.yml | 3 ++- ...ndirect_command_execution_via_forfiles.yml | 3 +++ ..._indirect_command_execution_via_pcalua.yml | 3 +++ ...mmand_execution_via_series_of_forfiles.yml | 5 +++- ..._input_capture_using_credential_ui_dll.yml | 5 +++- ...ndows_installutil_in_non_standard_path.yml | 5 +++- .../windows_installutil_uninstall_option.yml | 5 +++- ...ndows_ldifde_directory_object_behavior.yml | 3 ++- ...dows_linked_policies_in_adsi_discovery.yml | 5 +++- ...mimikatz_crypto_export_file_extensions.yml | 5 +++- ...y_registry_authenticationleveloverride.yml | 5 +++- ...dows_modify_registry_auto_update_notif.yml | 5 ++-- .../windows_modify_registry_disable_rdp.yml | 5 +++- ...y_registry_disable_toast_notifications.yml | 5 +++- ...y_disable_win_defender_raw_write_notif.yml | 5 +++- ...stry_disable_windefender_notifications.yml | 3 ++- ..._disable_windows_security_center_notif.yml | 5 +++- ...registry_disableremotedesktopantialias.yml | 5 +++- ...odify_registry_disablesecuritysettings.yml | 5 +++- ...modify_registry_disabling_wer_settings.yml | 5 +++- ...s_modify_registry_disallow_windows_app.yml | 5 +++- ..._registry_do_not_connect_to_win_update.yml | 5 ++-- .../windows_modify_registry_dontshowui.yml | 5 +++- ...odify_registry_enablelinkedconnections.yml | 3 ++- ...ndows_modify_registry_longpathsenabled.yml | 3 ++- ...modify_registry_maxconnectionperserver.yml | 5 +++- ...egistry_no_auto_reboot_with_logon_user.yml | 5 ++-- ...windows_modify_registry_no_auto_update.yml | 5 ++-- ...fy_registry_on_smart_card_group_policy.yml | 5 +++- .../windows_modify_registry_proxyenable.yml | 5 +++- .../windows_modify_registry_proxyserver.yml | 5 +++- ...y_registry_suppress_win_defender_notif.yml | 5 +++- ...dows_modify_registry_tamper_protection.yml | 5 ++-- ...w_compress_color_and_info_tip_registry.yml | 5 +++- ..._mof_event_triggered_execution_via_wmi.yml | 5 +++- .../windows_msiexec_dllregisterserver.yml | 5 +++- .../windows_msiexec_remote_download.yml | 5 +++- ...s_msiexec_unregister_dllregisterserver.yml | 5 +++- ...d_to_authenticate_from_host_using_ntlm.yml | 5 +++- .../windows_net_system_service_discovery.yml | 5 +++- ...dows_network_share_interaction_via_net.yml | 7 ++++-- ...windows_network_sniffing_tool_executed.yml | 7 +++++- ...ity_descriptor_set_on_eventlog_channel.yml | 5 +++- ...ntlog_channelaccess_registry_value_set.yml | 5 +++- .../endpoint/windows_nirsoft_advancedrun.yml | 5 +++- .../endpoint/windows_nirsoft_utilities.yml | 5 +++- ...ows_non_system_account_targeting_lsass.yml | 5 +++- .../endpoint/windows_odbcconf_hunting.yml | 7 +++++- .../endpoint/windows_odbcconf_load_dll.yml | 5 +++- .../windows_odbcconf_load_response_file.yml | 5 +++- ..._outlook_webview_registry_modification.yml | 5 +++- ...dows_parent_pid_spoofing_with_explorer.yml | 5 +++- .../windows_possible_credential_dumping.yml | 5 +++- ...indows_powershell_disable_http_logging.yml | 5 +++- .../windows_powershell_export_certificate.yml | 5 +++- ...ndows_powershell_export_pfxcertificate.yml | 5 +++- ...rshell_get_ciminstance_remote_computer.yml | 5 +++- ...l_iis_components_webglobalmodule_usage.yml | 5 +++- .../windows_powershell_scheduletask.yml | 3 ++- ...erview_kerberos_service_ticket_request.yml | 5 +++- .../endpoint/windows_proxy_via_netsh.yml | 3 ++- .../endpoint/windows_proxy_via_registry.yml | 3 ++- ...dows_registry_bootexecute_modification.yml | 5 +++- .../windows_registry_certificate_added.yml | 5 +++- ...y_dotnet_etw_disabled_via_env_variable.yml | 11 +++++++- ...modification_for_safe_mode_persistence.yml | 7 +++++- .../windows_remote_create_service.yml | 5 +++- ..._root_domain_linked_policies_discovery.yml | 5 +++- .../windows_runmru_command_execution.yml | 3 ++- ...curity_descriptor_tampering_via_sc_exe.yml | 5 +++- ...ows_sensitive_group_discovery_with_net.yml | 5 +++- ...ive_registry_hive_dump_via_commandline.yml | 7 +++++- .../windows_service_create_with_tscon.yml | 5 +++- ..._service_creation_using_registry_entry.yml | 5 +++- .../windows_service_execution_remcom.yml | 5 +++- .../endpoint/windows_service_stop_attempt.yml | 5 +++- ...snake_malware_file_modification_crmlog.yml | 3 ++- ...s_snake_malware_kernel_driver_comadmin.yml | 3 ++- ...istry_modification_wav_openwithprogids.yml | 3 ++- .../windows_snake_malware_service_create.yml | 3 ++- .../endpoint/windows_sqlcmd_execution.yml | 5 +++- ..._authentication_certificates_cryptoapi.yml | 5 +++- ...cation_certificates_export_certificate.yml | 5 +++- ...ion_certificates_export_pfxcertificate.yml | 5 +++- .../endpoint/windows_subinacl_execution.yml | 5 +++- ...execution_compiled_html_file_decompile.yml | 5 +++- ...em_network_connections_discovery_netsh.yml | 5 +++- ...oxy_execution_syncappvpublishingserver.yml | 5 +++- ...dows_system_time_discovery_w32tm_delay.yml | 5 +++- ...indows_system_user_discovery_via_quser.yml | 7 +++++- .../windows_wmi_process_call_create.yml | 5 +++- ...windows_wmi_reconnaissance_class_query.yml | 9 ++++++- .../windows_wmic_shadowcopy_delete.yml | 5 +++- .../windows_wmic_systeminfo_discovery.yml | 5 +++- .../wmi_permanent_event_subscription.yml | 9 ++++++- ..._permanent_event_subscription___sysmon.yml | 9 ++++++- detections/endpoint/wmic_group_discovery.yml | 5 +++- .../endpoint/wmic_xsl_execution_via_url.yml | 5 +++- .../xsl_script_execution_with_wmic.yml | 5 +++- 288 files changed, 1254 insertions(+), 306 deletions(-) diff --git a/detections/application/detect_html_help_spawn_child_process.yml b/detections/application/detect_html_help_spawn_child_process.yml index 0b070d3838..27905230b3 100644 --- a/detections/application/detect_html_help_spawn_child_process.yml +++ b/detections/application/detect_html_help_spawn_child_process.yml @@ -2,7 +2,7 @@ name: Detect HTML Help Spawn Child Process id: 723716de-ee55-4cd4-9759-c44e7e55ba4b version: 16 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 5cb87818-0d7c-4469-b7ef-9224107aebe8 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index e09ae3823a..bb435a02c5 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -2,7 +2,7 @@ name: Access LSASS Memory for Dump Creation id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 version: 16 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, w known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 9092c986ea..9e7ebdc39c 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -2,7 +2,7 @@ name: AdsiSearcher Account Discovery id: de7fcadc-04f3-11ec-a241-acde48001122 version: 13 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -27,6 +27,7 @@ references: - https://attack.mitre.org/techniques/T1087/002/ - https://www.blackhillsinfosec.com/red-blue-purple/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L234 drilldown_searches: - name: View the detection results for - "$dest$" and "$user_id$" search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' @@ -55,6 +56,8 @@ analytic_story: - Data Destruction - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 02e8be5a-3065-4e54-8cc8-a14d138834d3 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 9db0967a1f..c2c09667a3 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -2,7 +2,7 @@ name: BCDEdit Failure Recovery Modification id: 809b31d2-5462-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators may modify the boot configuration. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L66 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Void Manticore asset_type: Endpoint +atomic_guid: + - cf21060a-80b3-4238-a595-22525de4ab81 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index b7f6c0dce0..d60fb19be3 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -2,7 +2,7 @@ name: BITS Job Persistence id: e97a5ffe-90bf-11eb-928a-acde48001122 version: 13 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml#L51 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - BITS Jobs - Living Off The Land asset_type: Endpoint +atomic_guid: + - 62a06ec5-5754-47d2-bcfc-123d8314c6ae mitre_attack_id: - T1197 product: diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index ec76c0eedf..76c73828b1 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -2,7 +2,7 @@ name: BITSAdmin Download File id: 80630ff4-8e4c-11eb-aab5-acde48001122 version: 18 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Sittikorn S status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md - https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L236 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b mitre_attack_id: - T1197 - T1105 diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 42845a1248..69b55219b9 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -2,7 +2,7 @@ name: CertUtil With Decode Argument id: bfe94226-8c10-11eb-a4b3-acde48001122 version: 15 creation_date: '2021-03-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L25 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -70,6 +71,8 @@ threat_group: - Cozy Bear - Midnight Blizzard asset_type: Endpoint +atomic_guid: + - 71abc534-3c05-4d0c-80f7-cbe93cb2aa94 mitre_attack_id: - T1140 product: diff --git a/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml index e7875db3e4..eaf17da0a9 100644 --- a/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml @@ -2,7 +2,7 @@ name: Cisco Isovalent - Curl Execution With Insecure Flags id: c16c4899-d3f7-461b-92c2-cc0ef5758855 version: 5 creation_date: '2026-01-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ known_false_positives: This activity may be triggered by legitimate administrati references: - https://rawcode7.medium.com/understanding-the-kubernetes-attack-surface-9a48ebcb6bc4 - https://www.tutorialworks.com/kubernetes-curl/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L1275 drilldown_searches: - name: View the detection results for - "$pod_name$" search: '%original_detection_search% | search pod_name = "$pod_name$"' diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 49b1b9120d..7eb280d820 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -2,7 +2,7 @@ name: Control Loading from World Writable Directory id: 10423ac4-10c9-11ec-8dc4-acde48001122 version: 13 creation_date: '2021-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -20,6 +20,7 @@ references: - https://attack.mitre.org/techniques/T1218/011/ - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.002/T1218.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2021-40444 +atomic_guid: + - 037e9d8a-9e46-4255-8b33-2ae3b545ca6f mitre_attack_id: - T1218.002 product: diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 88e5ff9751..d5039c90a2 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -2,7 +2,7 @@ name: Create or delete windows shares using net exe id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -30,6 +30,8 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate. references: - https://attack.mitre.org/techniques/T1070/005/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070.005/T1070.005.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070.005/T1070.005.yaml#L21 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +65,9 @@ analytic_story: - Prestige Ransomware - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 14c38f32-6509-46d8-ab43-d53e32d2b131 + - 09210ad5-1ef2-4077-9ad3-7351e13e9222 mitre_attack_id: - T1070.005 product: diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 25294be65c..c0b325b230 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -2,7 +2,7 @@ name: Creation of lsass Dump with Taskmgr id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd version: 15 creation_date: '2019-12-11' -modification_date: '2026-09-21' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager - https://attack.mitre.org/techniques/T1003/001/ - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L122 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: - Seashell Blizzard - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - dea6c349-f1c6-44f3-87a1-1ed33a59a607 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 05b52a9935..d5262c808c 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -2,7 +2,7 @@ name: Creation of Shadow Copy id: eb120f5f-b879-4a63-97c1-93352b5df844 version: 13 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -33,6 +33,8 @@ known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will c references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L116 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +64,9 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - dcebead7-6c28-4b4b-bf3c-79deb1b1fc7f + - 224f7de0-8f0a-4a94-b5d8-989b036c86da mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index f6257bbe42..92750935e2 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -2,7 +2,7 @@ name: Creation of Shadow Copy with wmic and powershell id: 2ed8b538-d284-449a-be1d-82ad1dbd186b version: 15 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: Legitimate administrator usage of wmic to create a shadow references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L116 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L204 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +61,9 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - 224f7de0-8f0a-4a94-b5d8-989b036c86da + - 542bb97e-da53-436b-8e43-e0a7d31a6c24 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index c62a95e452..39fdc97d94 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -2,7 +2,7 @@ name: Credential Dumping via Copy Command from Shadow Copy id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L31 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - c6237146-9ea6-4711-85c9-c56d263a6b03 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 4363f7400e..2dc83ba016 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -2,7 +2,7 @@ name: Credential Dumping via Symlink to Shadow Copy id: c5eac648-fae0-4263-91a6-773df1f4c903 version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L228 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - 21748c28-2793-4284-9e07-d6d028b66702 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index c5148d86a4..55a0ec44a1 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -2,7 +2,7 @@ name: Delete ShadowCopy With PowerShell id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 version: 13 creation_date: '2021-05-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: No false positives have been identified at this time. references: - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations - https://www.techtarget.com/searchwindowsserver/tutorial/Set-up-PowerShell-script-block-logging-for-added-security + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L82 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -55,6 +56,8 @@ analytic_story: - Cactus Ransomware - VanHelsing Ransomware asset_type: Endpoint +atomic_guid: + - 39a295ca-7059-4a88-86f6-09556c1211e7 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index a631794038..4e8f64722a 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -2,7 +2,7 @@ name: Deleting Shadow Copies id: b89919ed-ee5f-492c-b139-95dbb162039e version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare. references: - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -80,6 +81,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Void Manticore asset_type: Endpoint +atomic_guid: + - 43819286-91a9-4369-90ed-d31fb4da2c01 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 975c102a40..a7052b3dca 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -2,7 +2,7 @@ name: Detect Credential Dumping through LSASS access id: 2c365e57-4414-4540-8dc0-73ab10729996 version: 16 creation_date: '2019-12-11' -modification_date: '2026-09-08' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -49,6 +49,7 @@ known_false_positives: The activity may be legitimate. Other tools can access ls references: - https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/ - https://attack.mitre.org/techniques/T1003/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$TargetImage$" search: '%original_detection_search% | search dest = "$dest$" TargetImage = "$TargetImage$"' @@ -75,6 +76,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index b12bf89d2b..5cd4424c36 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Detect HTML Help URL in Command Line id: 8c5835b9-39d9-438b-817c-95f14c69a31e version: 17 creation_date: '2021-02-11' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ references: - https://blog.sevagas.com/?Hacking-around-HTA-files - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L30 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -68,6 +69,8 @@ analytic_story: - Compromised Windows Host - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - 0f8af516-9818-4172-922b-42986ef1e81d mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 246aba48a5..874d1399a0 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -2,7 +2,7 @@ name: Detect HTML Help Using InfoTech Storage Handlers id: 0b2eefa5-5508-450d-b970-3dd2fb761aec version: 15 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L121 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 4f83adda-f5ec-406d-b318-9773c9ca92e5 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index 444545ff5e..bac8267504 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -2,7 +2,7 @@ name: Detect mshta inline hta execution id: a0873b32-5b68-11eb-ae93-0242ac130002 version: 22 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,9 @@ references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +74,10 @@ analytic_story: - APT37 Rustonotto and FadeStealer - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - 1483fab9-4f52-4217-a9ce-daa9d7747cae + - 906865c3-e05f-4acc-85c4-fbc185455095 + - 8707a805-2b76-4f32-b1c0-14e558205772 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index a38dbcb988..e2e3393837 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Detect MSHTA Url in Command Line id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 version: 21 creation_date: '2020-04-29' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing - https://denwp.com/dissecting-lumma-malware/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L32 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -73,6 +74,8 @@ analytic_story: - NetSupport RMM Tool Abuse - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - c4b97eeb-5249-4455-a607-59f95485cb45 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 10c569305e..f3230cf3a9 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -2,7 +2,7 @@ name: Detect New Local Admin account id: b25f6f62-0712-43c1-b203-083231ffd97d version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -36,7 +36,8 @@ search: | | `detect_new_local_admin_account_filter` how_to_implement: You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 known_false_positives: The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L156 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -65,6 +66,8 @@ analytic_story: - CISA AA24-241A - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - fda74566-a604-4581-a4cc-fbbe21d66559 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 3c269270f4..0e9292cc27 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -2,7 +2,7 @@ name: Detect Path Interception By Creation Of program exe id: cbef820c-e1ff-407f-887f-0a9240a2d477 version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.009/T1574.009.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Windows Persistence Techniques - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 2770dea7-c50f-457b-84c4-c40a47460d9f mitre_attack_id: - T1574.009 product: diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index cdc2f6698e..847e1b446b 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -2,7 +2,7 @@ name: Detect PsExec With accepteula Flag id: 27c3a83d-cada-47c6-9042-67baf19d2574 version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine references: - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.002/T1021.002.yaml#L55 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - VanHelsing Ransomware - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 0eb03d41-79e4-4393-8e57-6344856be1cf mitre_attack_id: - T1021.002 product: diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index d6c5a7d777..6c4e565d05 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -2,7 +2,7 @@ name: Detect Regsvr32 Application Control Bypass id: 070e9b80-6252-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ - https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.010/T1218.010.yaml#L38 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - BlackByte Ransomware - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint +atomic_guid: + - c9d0c4ef-8a96-4794-a75b-3d3a5e6f2a36 mitre_attack_id: - T1218.010 product: diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index b80e1ec8b9..b579e35a22 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -2,7 +2,7 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' +modification_date: '2026-10-09' author: Steven Dick, Sebastian Wurl, Splunk Community status: production type: Anomaly @@ -34,6 +34,17 @@ references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L95 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L222 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L250 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L287 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L314 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L342 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L371 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L452 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L483 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L509 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -77,6 +88,18 @@ analytic_story: - Scattered Lapsus$ Hunters - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0 + - d03683ec-aae0-42f9-9b4c-534780e0f8e1 + - 0ae9e327-3251-465a-a53b-485d4e3f58fa + - fbff3f1f-b0bf-448e-840f-7e1687affdce + - ecca999b-e0c8-40e8-8416-ad320b146a75 + - 19acf63b-55c4-4b6a-8552-00a8865105c8 + - 42e51815-a6cc-4c75-b970-3f0ff54b610e + - b1b8128b-c5d4-4de9-bf70-e60419274562 + - b025c580-029e-4023-888d-a42710d76934 + - 3e1858ee-3550-401c-86ec-5e70ed79295b + - 1aea6d15-70f1-4b4e-8b02-397b5d5ffe75 mitre_attack_id: - T1219 product: diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 55da551a7b..84014e941a 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -2,7 +2,7 @@ name: Detect Rundll32 Inline HTA Execution id: 91c79f14-5b41-11eb-ae93-0242ac130002 version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,8 @@ references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L25 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L42 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -54,6 +56,9 @@ analytic_story: - Living Off The Land - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 638730e7-7aed-43dc-bf8c-8117f805f5bb + - 32d1cf1b-cbc2-4c09-8d05-07ec5c83a821 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index 63bdf21836..29bf819406 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -2,7 +2,7 @@ name: Detect SharpHound Command-Line Arguments id: a0bdd2f6-c2ff-11eb-b918-acde48001122 version: 12 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - Ransomware - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index 37561415c3..30c27dcd9d 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -2,7 +2,7 @@ name: Detect SharpHound File Modifications id: 42b4b438-beed-11eb-ba1d-acde48001122 version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -55,6 +56,8 @@ analytic_story: - Ransomware - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index ae3e4b97b9..db38a68f5d 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -2,7 +2,7 @@ name: Detect SharpHound Usage id: dd04b29a-beed-11eb-87bc-acde48001122 version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -56,6 +57,8 @@ analytic_story: - Windows Discovery Techniques - Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 1e8c89f64a..0f2a1fc0a0 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -2,7 +2,7 @@ name: Disable ETW Through Registry id: f0eacfa4-d33f-11eb-8f9d-acde48001122 version: 15 creation_date: '2021-06-23' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: network operator may disable this feature of windows but not so common. references: - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1571 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1581 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +36,9 @@ analytic_story: - CISA AA23-347A - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 8a4c33be-a0d3-434a-bee6-315405edbd5b + - 19c07a45-452d-4620-90ed-4c34fffbe758 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 6781010042..88c0511f90 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -2,7 +2,7 @@ name: Disable Logs Using WevtUtil id: 236e7c8e-c9d9-11eb-a824-acde48001122 version: 14 creation_date: '2021-06-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: network operator may disable audit event logs for debugging purposes. references: - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L105 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - CISA AA23-347A - Rhysida Ransomware asset_type: Endpoint +atomic_guid: + - b26a3340-dad7-4360-9176-706269c74103 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 95c6027ece..29007d8b5c 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -2,7 +2,7 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 version: 17 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L174 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - ac34b0f7-0f85-4ac0-b93e-3ced2bc69bb8 mitre_attack_id: - T1112 - T1685 diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index f01e4f92e9..d08ed0971c 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -2,7 +2,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 version: 24 creation_date: '2021-03-31' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -31,6 +31,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1051 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer asset_type: Endpoint +atomic_guid: + - a72cfef8-d252-48b3-b292-635d332625c3 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index ca614ff952..947161c2e4 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -2,7 +2,7 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 version: 17 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L188 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - d2561a6d-72bd-408c-b150-13efe1801c2a mitre_attack_id: - T1112 - T1685 diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 3e4d52301e..3332cbc903 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -2,7 +2,7 @@ name: Disabling Remote User Account Control id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Patrick Bareiss, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. known_false_positives: This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L151 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -42,6 +43,8 @@ analytic_story: - Azorult - AgentTesla asset_type: Endpoint +atomic_guid: + - 9e8af564-53ec-407e-aaa8-3cb20c3af7f9 mitre_attack_id: - T1548.002 product: diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 1d00844d93..3a75b8fc09 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -2,7 +2,7 @@ name: Disabling SystemRestore In Registry id: f4f837e2-91fb-11eb-8bf6-acde48001122 version: 15 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: in some cases admin can disable systemrestore on a machine. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L132 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - 66e647d1-8741-4e43-b7c1-334760c2047f mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index 1a3b7b14d2..4913e9b7ab 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -2,7 +2,7 @@ name: Domain Group Discovery with Adsisearcher id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 version: 14 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use Adsisearcher for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L150 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 9f4e344b-8434-41b3-85b1-d38f29d148d0 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 0897dbdc89..12add244b6 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -2,7 +2,7 @@ name: DSQuery Domain Discovery id: cc316032-924a-11eb-91a2-acde48001122 version: 13 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - Domain Trust Discovery - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 4700a710-c821-4e17-a3ec-9e4c81d6845f mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index e5bad39bcf..ce62844c17 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -2,7 +2,7 @@ name: Dump LSASS via comsvcs DLL id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 version: 17 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Patrick Bareiss, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ - https://twitter.com/SBousseaden/status/1167417096374050817 - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L45 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -73,6 +74,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - 2536dee2-12fb-459a-8c37-971844fa73be mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index c02b721f03..f83b777679 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -2,7 +2,7 @@ name: Dump LSASS via procdump id: 3742ebfe-64c2-11eb-ae93-0242ac130002 version: 20 creation_date: '2021-02-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -76,6 +76,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://x.com/wietze/status/1958302556033065292?s=12 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -110,6 +111,8 @@ analytic_story: - Seashell Blizzard - Storm-2460 CLFS Zero Day Exploitation asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index e207d4573f..e2c065432a 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -2,7 +2,7 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 version: 16 creation_date: '2021-10-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L39 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L54 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +42,9 @@ analytic_story: - Windows Registry Abuse - CISA AA22-320A asset_type: Endpoint +atomic_guid: + - c0413fb5-33e2-40b7-9b6f-60b29f4a7a18 + - 68254a85-aa42-4312-a695-38b7276307f8 mitre_attack_id: - T1112 - T1003 diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index bff789bd1f..508a661ec4 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -2,7 +2,7 @@ name: Esentutl SAM Copy id: d372f928-ce4f-11eb-a762-acde48001122 version: 10 creation_date: '2021-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -31,10 +31,13 @@ known_false_positives: False positives should be limited. Filter as needed. references: - https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md - https://attack.mitre.org/software/S0404/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L66 analytic_story: - Credential Dumping - Living Off The Land asset_type: Endpoint +atomic_guid: + - a90c2f4d-6726-444e-99d2-a00cd7c20480 mitre_attack_id: - T1003.002 product: diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 9238e5d7ff..277d02f452 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -2,7 +2,7 @@ name: Eventvwr UAC Bypass id: 9cf8fe08-7ad8-11eb-9819-acde48001122 version: 13 creation_date: '2021-03-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Steven Dick, Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,8 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md - https://attack.mitre.org/techniques/T1548/002/ - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L24 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -45,6 +47,9 @@ analytic_story: - Windows Registry Abuse - ValleyRAT asset_type: Endpoint +atomic_guid: + - 5073adf8-9a50-4bd9-b298-a9bd2ead8af9 + - a6ce9acf-842a-4af6-8f79-539be7608e2b mitre_attack_id: - T1548.002 product: diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 6faaff19d7..f42622c18f 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -2,7 +2,7 @@ name: FodHelper UAC Bypass id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 version: 15 creation_date: '2021-03-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,8 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md - https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 - https://attack.mitre.org/techniques/T1548/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L64 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +65,9 @@ analytic_story: - Windows Defense Evasion Tactics - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - 58f641ea-12e3-499a-b684-44dee46bd182 + - 3f627297-6c38-4e7d-a278-fc2563eaaeaa mitre_attack_id: - T1112 - T1548.002 diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index 35e8d5cd71..94aabd68e7 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -2,7 +2,7 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell id: 36e46ebe-065a-11ec-b4c7-acde48001122 version: 10 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -49,9 +49,12 @@ references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet - https://attack.mitre.org/techniques/T1201/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml#L110 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - b2698b33-984c-4a1c-93bb-e4ba72a0babb mitre_attack_id: - T1201 product: diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index bb2744dac8..0fd84d5b52 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -2,7 +2,7 @@ name: Get ADUser with PowerShell id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 version: 10 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Hunting @@ -36,10 +36,13 @@ references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://attack.mitre.org/techniques/T1087/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L17 analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 8b8a6449-be98-4f42-afd2-dedddc7453b2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index b6c105338e..7d47e8dcce 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: Get ADUser with PowerShell Script Block id: 21432e40-04f4-11ec-b7e6-acde48001122 version: 10 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Hunting @@ -27,10 +27,13 @@ references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://attack.mitre.org/techniques/T1087/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L17 analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 8b8a6449-be98-4f42-afd2-dedddc7453b2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index 19669f89fd..6a4263494e 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -2,7 +2,7 @@ name: Get DomainPolicy with Powershell id: b8f9947e-065a-11ec-aafb-acde48001122 version: 11 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ - https://attack.mitre.org/techniques/T1201/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml#L99 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 3177f4da-3d4b-4592-8bdc-aa23d0b2e843 mitre_attack_id: - T1201 product: diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index 8276c690bd..f74ffdc7a4 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -2,7 +2,7 @@ name: Get-DomainTrust with PowerShell id: 4fa7f846-054a-11ec-a836-acde48001122 version: 10 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. references: - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L118 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ intermediate_findings: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - f974894c-5991-4b19-aaf5-7cc2fe298c5d mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index a8879480e6..88ec1582df 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -2,7 +2,7 @@ name: Get DomainUser with PowerShell id: 9a5a41d6-04e7-11ec-923c-acde48001122 version: 12 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L223 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 93662494-5ed7-4454-a04c-8c8372808ac2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index 41c578874e..e64ae44fd8 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -2,7 +2,7 @@ name: Get-ForestTrust with PowerShell id: 584f4884-0bf1-11ec-a5ec-acde48001122 version: 10 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L130 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -55,6 +56,8 @@ intermediate_findings: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 58ed10e8-0738-4651-8408-3a3e9a526279 mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index dcba3dc093..4598e7afaa 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -2,7 +2,7 @@ name: Get WMIObject Group Discovery id: 5434f670-155d-11ec-8cca-acde48001122 version: 9 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -35,9 +35,12 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L94 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 69119e58-96db-4110-ad27-954e48f3bb13 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml index 3a2cdee9a5..06687a5f05 100644 --- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml +++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml @@ -2,7 +2,7 @@ name: Get WMIObject Group Discovery with Script Block Logging id: 69df7f7c-155d-11ec-a055-acde48001122 version: 11 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,12 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L94 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 69119e58-96db-4110-ad27-954e48f3bb13 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml index 600cf3dc6d..4c45f3b055 100644 --- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetAdComputer with PowerShell Script Block id: a9a1da02-8e27-4bf7-a348-f4389c9da487 version: 11 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -25,12 +25,15 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1018/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L346 analytic_story: - Active Directory Discovery - CISA AA22-320A - Medusa Ransomware - Gozi Malware asset_type: Endpoint +atomic_guid: + - 97e89d9e-e3f5-41b5-a90f-1e0825df0fdf mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index 997e7928c3..c1bbefd3b0 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -2,7 +2,7 @@ name: GetAdGroup with PowerShell id: 872e3063-0fc4-4e68-b2f3-f2b99184a708 version: 9 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -33,9 +33,12 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L19 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 6d5d8c96-3d2a-4da9-9d6d-9a9d341899a7 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index 42f816782f..6e962e2892 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetAdGroup with PowerShell Script Block id: e4c73d68-794b-468d-b4d0-dac1772bbae7 version: 12 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -26,10 +26,13 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1069/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L19 analytic_story: - Scattered Lapsus$ Hunters - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 6d5d8c96-3d2a-4da9-9d6d-9a9d341899a7 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml index 543c998725..4920d258f4 100644 --- a/detections/endpoint/getcurrent_user_with_powershell.yml +++ b/detections/endpoint/getcurrent_user_with_powershell.yml @@ -2,7 +2,7 @@ name: GetCurrent User with PowerShell id: 7eb9c3d5-c98c-4088-acc5-8240bad15379 version: 8 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L67 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 1392bd0f-5d5a-429e-81d9-eb9d4d4d5b3b mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml index bda0937e98..a1f4716abc 100644 --- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml +++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetCurrent User with PowerShell Script Block id: 80879283-c30f-44f7-8471-d1381f6d437a version: 10 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -26,9 +26,12 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1033/ - https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-6.0&viewFallbackFrom=net-5.0 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml index 6d257dfc2b..47c45c98fc 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell.yml @@ -2,7 +2,7 @@ name: GetDomainController with PowerShell id: 868ee0e4-52ab-484a-833a-6d85b7c028d0 version: 8 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -33,9 +33,12 @@ known_false_positives: Administrators or power users may use PowerView for troub references: - https://attack.mitre.org/techniques/T1018/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L372 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - b9d2e8ca-5520-4737-8076-4f08913da2c4 mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 538ed03bad..4a0f23382c 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -2,7 +2,7 @@ name: GetDomainGroup with PowerShell id: 93c94be3-bead-4a60-860f-77ca3fe59903 version: 11 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -33,6 +33,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L200 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -51,6 +52,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 5a8a181c-2c8e-478d-a943-549305a01230 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index 0e920c4bf7..a02305e903 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetDomainGroup with PowerShell Script Block id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 version: 13 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this PowerView func references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L138 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -44,6 +45,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 3d1fcd2a-e51c-4cbe-8d84-9a843bad8dc8 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index 4401f35638..e5b1606c69 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -2,7 +2,7 @@ name: GetLocalUser with PowerShell id: 85fae8fa-0427-11ec-8b78-acde48001122 version: 9 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. references: - https://attack.mitre.org/techniques/T1087/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.001/T1087.001.yaml#L151 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - ae4b6361-b5f8-46cb-a3f9-9cf108ccfe7b mitre_attack_id: - T1087.001 product: diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index 484c938c43..fa061c119e 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -2,7 +2,7 @@ name: GetWmiObject Ds Computer with PowerShell id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 version: 9 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Anomaly @@ -54,6 +54,7 @@ known_false_positives: |- Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1018/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L383 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -77,6 +78,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - e3cf5123-f6c9-4375-bdf2-1bb3ba43a1ad mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 13d308b078..b23955db43 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -2,7 +2,7 @@ name: Hiding Files And Directories With Attrib exe id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1 version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -27,7 +27,8 @@ search: |- | `hiding_files_and_directories_with_attrib_exe_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Some applications and users may legitimately use attrib.exe to interact with the files. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L90 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - Crypto Stealer - VIP Keylogger asset_type: Endpoint +atomic_guid: + - 32b979da-7b68-42c9-9a99-0e39900fc36c mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml index a2989a0e6a..c0a9f61513 100644 --- a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml @@ -2,7 +2,7 @@ name: Impacket Lateral Movement WMIExec Commandline Parameters id: d6e464e4-5c6a-474e-82d2-aed616a3a492 version: 12 creation_date: '2021-11-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -24,6 +24,7 @@ references: - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L238 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - CISA AA22-277A - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - a3ddaf15-d1a1-4bc3-8683-84c7c67120fe mitre_attack_id: - T1021.002 - T1021.003 diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index a986cf92e7..59273ca788 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -2,7 +2,7 @@ name: Kerberoasting spn request with RC4 encryption id: 5cc67381-44fa-4111-8a37-7a230943f027 version: 15 creation_date: '2020-06-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Dean Luxton, Splunk status: production type: TTP @@ -23,6 +23,8 @@ known_false_positives: Older systems that support kerberos RC4 by default like N references: - https://github.com/redcanaryco/atomic-red-team/blob/4e3e9c8096dde00639a6b98845ec349135554ed5/atomics/T1208/T1208.md - https://www.hub.trimarcsecurity.com/post/trimarc-research-detecting-kerberoasting-activity + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L30 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +47,9 @@ analytic_story: - Compromised Windows Host - Hermetic Wiper asset_type: Endpoint +atomic_guid: + - 3f987809-3681-43c8-bcd8-b3ff3a28533a + - 14625569-6def-4497-99ac-8e7817105b55 mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index 5dde70f353..c15a28e179 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -2,7 +2,7 @@ name: Linux Add User Account id: 51fbcaf2-6259-11ec-b0f3-acde48001122 version: 10 creation_date: '2022-01-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Hunting @@ -30,11 +30,14 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L5 analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques - Cisco Isovalent Suspicious Activity asset_type: Endpoint +atomic_guid: + - 40d8eabd-e394-46f6-8785-b9bfa1d011d2 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index a1d7ffa650..0311793793 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -2,7 +2,7 @@ name: Linux At Application Execution id: bf0a378e-5f3c-11ec-a6de-acde48001122 version: 13 creation_date: '2021-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://attack.mitre.org/techniques/T1053/001/ - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.002/T1053.002.yaml#L20 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,7 +54,7 @@ analytic_story: - Cisco Isovalent Suspicious Activity asset_type: Endpoint atomic_guid: - - 9ddf2e5e-7e2c-46c2-9940-3c2ff29c7213 + - 7266d898-ac82-4ec0-97c7-436075d0d08e mitre_attack_id: - T1053.002 product: diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 9824c54cf7..cd965ede12 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -2,7 +2,7 @@ name: Linux Auditd Add User Account id: aae66dc0-74b4-4807-b480-b35f8027abb4 version: 10 creation_date: '2022-01-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -21,6 +21,7 @@ how_to_implement: To implement this detection, the process begins by ingesting a known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 40d8eabd-e394-46f6-8785-b9bfa1d011d2 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index bb9a48d432..79d77ca293 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -2,7 +2,7 @@ name: Linux Auditd Clipboard Data Copy id: 9ddfe470-c4d0-4e60-8668-7337bd699edd version: 9 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: False positives may be present on Linux desktop as it may references: - https://attack.mitre.org/techniques/T1115/ - https://linux.die.net/man/1/xclip + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml#L73 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ analytic_story: - Linux Living Off The Land - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - ee363e53-b083-4230-aff3-f8d955f2d5bb mitre_attack_id: - T1115 product: diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index dae8597a7a..068bfe8eca 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -2,7 +2,7 @@ name: Linux Auditd Dd File Overwrite id: d1b74420-4cea-4752-a123-9b40dfcca49a version: 9 creation_date: '2024-08-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -22,6 +22,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://gtfobins.github.io/gtfobins/dd/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml#L37 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,6 +43,8 @@ analytic_story: - Data Destruction - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 38deee99-fd65-4031-bec8-bfa4f9f26146 mitre_attack_id: - T1485 product: diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 4047605305..31443e4229 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd File And Directory Discovery id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1 version: 9 creation_date: '2024-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml#L40 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - ffc8b249-372a-4b74-adcd-e4c0430842de mitre_attack_id: - T1083 product: diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index c6646ed32d..d47d541e84 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -2,7 +2,7 @@ name: Linux Auditd Insert Kernel Module Using Insmod Utility id: bc0ca53f-dea6-4906-9b12-09c396fdf1d3 version: 11 creation_date: '2024-08-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint +atomic_guid: + - 687dcb93-9656-4853-9c36-9977315e9d23 mitre_attack_id: - T1547.006 product: diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 576808b5d5..03d5a7c4ca 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -2,7 +2,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 version: 13 creation_date: '2024-08-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd - https://attack.mitre.org/techniques/T1003/008/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.008/T1003.008.yaml#L61 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -38,6 +39,8 @@ analytic_story: - Linux Privilege Escalation - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - df1a55ae-019d-4120-bc35-94f4bc5c4b0a mitre_attack_id: - T1003.008 product: diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 93512a389e..096dc9401e 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -2,7 +2,7 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -23,6 +23,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://cert.gov.ua/article/39518 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L63 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -38,6 +39,8 @@ analytic_story: - AwfulShred - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 42e3a5bd-1e45-427f-aa08-2a65fa29a820 mitre_attack_id: - T1489 product: diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index d0c23eb7f1..0935ded19f 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd System Network Configuration Discovery id: 5db16825-81bd-4923-a8d6-d6a13a59832a version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -23,6 +23,7 @@ how_to_implement: To implement this detection, the process begins by ingesting a known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L33 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -44,6 +45,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - c141bbdb-7fca-4254-9fd6-f47e79447e17 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index 7fa8e37fef..99c021d2f8 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd Whoami User Discovery id: d1ff2e22-310d-446a-80b3-faedaa7b3b52 version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L131 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Compromised Linux Host - QuietVault asset_type: Endpoint +atomic_guid: + - aab580c7-cc30-4a7c-b5a9-46a29066b022 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/linux_clipboard_data_copy.yml b/detections/endpoint/linux_clipboard_data_copy.yml index 9aa385a01a..ff3d0c76b8 100644 --- a/detections/endpoint/linux_clipboard_data_copy.yml +++ b/detections/endpoint/linux_clipboard_data_copy.yml @@ -2,7 +2,7 @@ name: Linux Clipboard Data Copy id: 7173b2ad-6146-418f-85ae-c3479e4515fc version: 11 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -28,6 +28,7 @@ known_false_positives: False positives may be present on Linux desktop as it may references: - https://attack.mitre.org/techniques/T1115/ - https://linux.die.net/man/1/xclip + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml#L73 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ threat_objects: analytic_story: - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - ee363e53-b083-4230-aff3-f8d955f2d5bb mitre_attack_id: - T1115 product: diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml index 5421e5f8f4..52c42cdbf0 100644 --- a/detections/endpoint/linux_curl_upload_file.yml +++ b/detections/endpoint/linux_curl_upload_file.yml @@ -2,7 +2,7 @@ name: Linux Curl Upload File id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf version: 13 creation_date: '2022-07-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://curl.se/docs/manpage.html - https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/ - https://gtfobins.github.io/gtfobins/curl/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L501 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Ingress Tool Transfer - NPM Supply Chain Compromise asset_type: Endpoint +atomic_guid: + - 635c9a38-6cbf-47dc-8615-3810bc1167cf mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index db17611ba4..3db2e4903f 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -2,7 +2,7 @@ name: Linux DD File Overwrite id: 9b6aae5e-8d85-11ec-b2ae-acde48001122 version: 10 creation_date: '2022-02-15' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://gtfobins.github.io/gtfobins/dd/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml#L37 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Data Destruction - Industroyer2 asset_type: Endpoint +atomic_guid: + - 38deee99-fd65-4031-bec8-bfa4f9f26146 mitre_attack_id: - T1485 product: diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index e3e800b658..500697152f 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -2,7 +2,7 @@ name: Linux Decode Base64 to Shell id: 637b603e-1799-40fd-bf87-47ecbd551b66 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://linux.die.net/man/1/base64 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L240 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - Linux Living Off The Land - Cisco Isovalent Suspicious Activity asset_type: Endpoint +atomic_guid: + - 3a15c372-67c1-4430-ac8e-ec06d641ce4d mitre_attack_id: - T1027 - T1059.004 diff --git a/detections/endpoint/linux_docker_root_directory_mount.yml b/detections/endpoint/linux_docker_root_directory_mount.yml index d055ab84d4..e5e94296a0 100644 --- a/detections/endpoint/linux_docker_root_directory_mount.yml +++ b/detections/endpoint/linux_docker_root_directory_mount.yml @@ -2,7 +2,7 @@ name: Linux Docker Root Directory Mount id: aa049566-f76a-43b9-908c-3c27e079fd43 version: 4 creation_date: '2026-03-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Gowthamaraj Rajendran, Splunk, Emil Elsetrønning status: production type: TTP @@ -41,6 +41,7 @@ known_false_positives: False positives are present based on automated tooling or references: - https://docs.docker.com/engine/storage/volumes/ - https://gtfobins.github.io/gtfobins/docker/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1611/T1611.yaml#L59 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -69,6 +70,8 @@ analytic_story: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - 6c499943-b098-4bc6-8d38-0956fc182984 mitre_attack_id: - T1611 product: diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml index fa0e86065c..c117c573c2 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml @@ -2,7 +2,7 @@ name: Linux Ingress Tool Transfer Hunting id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ references: - https://curl.se/docs/manpage.html#-I - https://gtfobins.github.io/gtfobins/curl/ - https://github.com/rapid7/metasploit-framework/search?q=curl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L763 analytic_story: - Ingress Tool Transfer - Linux Living Off The Land @@ -41,6 +42,8 @@ analytic_story: - NPM Supply Chain Compromise - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - bdc373c5-e9cf-4563-8a7b-a9ba720a90f3 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml index b56bae8e7e..de6be1e215 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml @@ -2,7 +2,7 @@ name: Linux Ingress Tool Transfer with Curl id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ references: - https://curl.se/docs/manpage.html#-I - https://gtfobins.github.io/gtfobins/curl/ - https://github.com/rapid7/metasploit-framework/search?q=curl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L763 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - XorDDos - NPM Supply Chain Compromise asset_type: Endpoint +atomic_guid: + - bdc373c5-e9cf-4563-8a7b-a9ba720a90f3 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml index 254f4b5f1e..47e497dcdb 100644 --- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml @@ -2,7 +2,7 @@ name: Linux Insert Kernel Module Using Insmod Utility id: 18b5a1a0-6326-11ec-943a-acde48001122 version: 12 creation_date: '2022-01-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -31,6 +31,7 @@ references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - Linux Rootkit - Linux Privilege Escalation asset_type: Endpoint +atomic_guid: + - 687dcb93-9656-4853-9c36-9977315e9d23 mitre_attack_id: - T1547.006 product: diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml index 0d1d07356f..87223e336e 100644 --- a/detections/endpoint/linux_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_kernel_module_enumeration.yml @@ -2,7 +2,7 @@ name: Linux Kernel Module Enumeration id: 6df99886-0e04-4c11-8b88-325747419278 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -27,6 +27,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: - https://man7.org/linux/man-pages/man8/kmod.8.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L357 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -55,6 +56,8 @@ analytic_story: - XorDDos - Linux Rootkit asset_type: Endpoint +atomic_guid: + - 034fe21c-3186-49dd-8d5d-128b35f181c7 mitre_attack_id: - T1082 - T1014 diff --git a/detections/endpoint/linux_magic_sysrq_key_abuse.yml b/detections/endpoint/linux_magic_sysrq_key_abuse.yml index a11c81271a..72e51baaa8 100644 --- a/detections/endpoint/linux_magic_sysrq_key_abuse.yml +++ b/detections/endpoint/linux_magic_sysrq_key_abuse.yml @@ -2,7 +2,7 @@ name: Linux Magic SysRq Key Abuse id: 22c03600-f84a-47fa-abaa-ffbe3e72c782 version: 5 creation_date: '2025-08-28' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Milad Cheraghi status: production type: TTP @@ -62,6 +62,8 @@ references: - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L157 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml#L282 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest="$dest$"' @@ -80,6 +82,9 @@ finding: analytic_story: - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 6e76f56f-2373-4a6c-a63f-98b7b72761f1 + - d2a1f4bc-a064-4223-8281-a086dce5423c mitre_attack_id: - T1059.004 - T1529 diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml index 5781119150..3d698d7a8c 100644 --- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml @@ -2,7 +2,7 @@ name: Linux Obfuscated Files or Information Base64 Decode id: 303b38b2-c03f-44e2-8f41-4594606fcfc7 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://linux.die.net/man/1/base64 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -56,6 +57,8 @@ threat_objects: analytic_story: - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - f45df6be-2e1e-4136-a384-8f18ab3826fb mitre_attack_id: - T1027 product: diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml index ea69099097..3fa6d9e2a5 100644 --- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml +++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml @@ -2,7 +2,7 @@ name: Linux SSH Authorized Keys Modification id: f5ab595e-28e5-4327-8077-5008ba97c850 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -28,6 +28,7 @@ known_false_positives: Filtering will be required as system administrators will references: - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098.004/T1098.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098.004/T1098.004.yaml#L7 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Hellcat Ransomware - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - 342cc723-127c-4d3a-8292-9c0c6b4ecadc mitre_attack_id: - T1098.004 product: diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index 5a7f67486d..f41e115544 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -2,7 +2,7 @@ name: Linux System Network Discovery id: 535cb214-8b47-11ec-a2c7-acde48001122 version: 11 creation_date: '2022-02-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -65,6 +65,7 @@ known_false_positives: |- Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L33 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -91,6 +92,8 @@ analytic_story: - Industroyer2 - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - c141bbdb-7fca-4254-9fd6-f47e79447e17 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/linux_system_reboot_via_system_request_key.yml b/detections/endpoint/linux_system_reboot_via_system_request_key.yml index 9d3f412eb6..fae06269f2 100644 --- a/detections/endpoint/linux_system_reboot_via_system_request_key.yml +++ b/detections/endpoint/linux_system_reboot_via_system_request_key.yml @@ -2,7 +2,7 @@ name: Linux System Reboot Via System Request Key id: e1912b58-ed9c-422c-bbb0-2dbc70398345 version: 11 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html - https://cert.gov.ua/article/3718487 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml#L282 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - AwfulShred - Data Destruction asset_type: Endpoint +atomic_guid: + - d2a1f4bc-a064-4223-8281-a086dce5423c mitre_attack_id: - T1529 product: diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml index 79c9774b6e..2525ad03a2 100644 --- a/detections/endpoint/macos_gatekeeper_bypass.yml +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -2,7 +2,7 @@ name: MacOS Gatekeeper Bypass id: 2c9346f3-bbeb-48ce-8411-fc13d09d83a5 version: 3 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ - https://ss64.com/mac/xattr.html - https://ss64.com/mac/spctl.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1553.001/T1553.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -75,6 +76,8 @@ analytic_story: - MacOS Post-Exploitation - MacOS Persistence Techniques asset_type: Endpoint +atomic_guid: + - fb3d46c6-9480-4803-8d7d-ce676e1f1a9b mitre_attack_id: - T1553.001 product: diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml index 2e6aa92273..baa8affa24 100644 --- a/detections/endpoint/macos_keychains_dumped.yml +++ b/detections/endpoint/macos_keychains_dumped.yml @@ -2,7 +2,7 @@ name: MacOS Keychains Dumped id: dcb45a09-5e6f-441e-b2f8-cbbf923e36d9 version: 4 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Jamie Windley, Splunk status: production type: TTP @@ -70,6 +70,7 @@ references: - https://gist.github.com/hfeeki/88c12f01d00534e09a84 - https://ss64.com/mac/security-keychain-settings.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.001/T1555.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1555.001/T1555.001.yaml#L6 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -94,6 +95,8 @@ intermediate_findings: analytic_story: - MacOS Privilege Escalation asset_type: Endpoint +atomic_guid: + - 88e1fa00-bf63-4e5b-a3e1-e2ea51c8cca6 mitre_attack_id: - T1555.001 product: diff --git a/detections/endpoint/macos_list_firewall_rules.yml b/detections/endpoint/macos_list_firewall_rules.yml index 488af3e230..a09c47f4b1 100644 --- a/detections/endpoint/macos_list_firewall_rules.yml +++ b/detections/endpoint/macos_list_firewall_rules.yml @@ -2,7 +2,7 @@ name: MacOS List Firewall Rules id: f8db6e0b-55bb-40ca-bc85-2b3700adb0f8 version: 2 creation_date: '2026-04-15' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jamie Windley, Splunk status: production type: Anomaly @@ -52,6 +52,7 @@ known_false_positives: | references: - https://www.manpagez.com/man/8/socketfilterfw/ - https://ss64.com/mac/defaults.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L183 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" AND dest = "$dest$"' @@ -81,6 +82,8 @@ threat_objects: analytic_story: - Network Discovery asset_type: Endpoint +atomic_guid: + - ff1d8c25-2aa4-4f18-a425-fede4a41ee88 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml index e5a07e40a3..f5a37a09cc 100644 --- a/detections/endpoint/macos_network_share_discovery.yml +++ b/detections/endpoint/macos_network_share_discovery.yml @@ -2,7 +2,7 @@ name: MacOS Network Share Discovery id: a5f5fe52-8e50-4fb0-ad1b-780be6c0d857 version: 3 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ - https://leopard-adc.pepas.com/documentation/Darwin/Reference/ManPages/man8/showmount.8.html - https://www.unix.com/man_page/osx/1/smbutil/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ threat_objects: analytic_story: - MacOS Post-Exploitation asset_type: Endpoint +atomic_guid: + - f94b5ad9-911c-4eff-9718-fd21899db4f7 mitre_attack_id: - T1135 product: diff --git a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml index b3a93b8066..983787c0c0 100644 --- a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml +++ b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml @@ -2,7 +2,7 @@ name: MacOS Osascript Displaying Suspicious User Prompt id: d565ae18-7db6-460c-a2eb-a7109f18bc5e version: 1 creation_date: '2026-08-03' -modification_date: '2026-08-31' +modification_date: '2026-10-02' author: Radka Viskova, Splunk status: production type: Anomaly @@ -62,6 +62,8 @@ references: - https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1 - https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/ - https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L31 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -83,6 +85,9 @@ threat_objects: analytic_story: - MacOS Privilege Escalation asset_type: Endpoint +atomic_guid: + - b7037b89-947a-427a-ba29-e7e9f09bc045 + - 76628574-0bc1-4646-8fe2-8f4427b47d15 mitre_attack_id: - T1059.002 - T1056.002 diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 4155e06ea0..744d2ba42f 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -2,7 +2,7 @@ name: Malicious PowerShell Process - Encoded Command id: c4db14d9-7909-48b4-a054-aa14d89dbb19 version: 21 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community status: production type: Hunting @@ -48,6 +48,7 @@ references: - https://twitter.com/M_haggis/status/1440758396534214658?s=20 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L39 analytic_story: - SolarWinds WHD RCE Post Exploitation - CISA AA22-320A @@ -67,6 +68,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - a50d5a97-2531-499e-a1de-5544c74432c6 mitre_attack_id: - T1027 product: diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index eddcaed3e3..59f00a04fa 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -2,7 +2,7 @@ name: Monitor Registry Keys for Print Monitors id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: You will encounter noise from legitimate print-monitor registry entries. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.010/T1547.010.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - Windows Persistence Techniques - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - d34ef297-f178-4462-871e-9ce618d44e50 mitre_attack_id: - T1547.010 product: diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml index bb6f37b475..6373999c08 100644 --- a/detections/endpoint/network_share_discovery_via_dir_command.yml +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -2,7 +2,7 @@ name: Network Share Discovery Via Dir Command id: dc1457d0-1d9b-422e-b5a7-db46c184d9aa version: 7 creation_date: '2023-05-23' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -51,6 +51,7 @@ references: - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140#table-of-file-access-codes - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L166 analytic_story: - IcedID asset_type: Endpoint diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 4b5982ff64..6424ba1447 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -2,7 +2,7 @@ name: NLTest Domain Trust Discovery id: c3e05466-5f22-11eb-ae93-0242ac130002 version: 14 creation_date: '2021-01-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -40,6 +40,7 @@ references: - https://ss64.com/nt/nltest.html - https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/ - https://thedfirreport.com/2020/10/08/ryuks-return/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L16 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Ryuk Ransomware - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 2e22641d-0498-48d2-b9ff-c71e496ccdbe mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 500aedd2ca..7ebf6578f5 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -2,7 +2,7 @@ name: Ntdsutil Export NTDS id: da63bc76-61ae-11eb-ae93-0242ac130002 version: 12 creation_date: '2021-01-28' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Patrick Bareiss, Splunk status: production type: TTP @@ -35,6 +35,7 @@ references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L83 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: - Rhysida Ransomware - NetSupport RMM Tool Abuse asset_type: Endpoint +atomic_guid: + - 2364e33d-ceab-4641-8468-bfb1d7cc2723 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 7c7e480067..1cc5ecc0aa 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -2,7 +2,7 @@ name: Overwriting Accessibility Binaries id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -12,7 +12,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe* OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. known_false_positives: Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L50 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L125 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L141 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L157 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L173 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L189 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +43,13 @@ analytic_story: - Windows Privilege Escalation - Flax Typhoon asset_type: Endpoint +atomic_guid: + - 934e90cf-29ca-48b3-863c-411737ad44e3 + - 1db380da-3422-481d-a3c8-6d5770dba580 + - 5e4fa70d-c789-470e-85e1-6992b92bb321 + - 2002f5ea-cd13-4c82-bf73-e46722e5dc5e + - 825ba8ca-71cc-436b-b1dd-ea0d5e109086 + - 210be7ea-d841-40ec-b3e1-ff610bb62744 mitre_attack_id: - T1546.008 product: diff --git a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml index 8a3b89b114..c5982ee92c 100644 --- a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml @@ -2,7 +2,7 @@ name: Powershell COM Hijacking InprocServer32 Modification id: ea61e291-af05-4716-932a-67faddb6ae6f version: 10 creation_date: '2022-09-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,7 @@ references: - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.015/T1546.015.yaml#L5 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -35,6 +36,8 @@ finding: analytic_story: - Malicious PowerShell asset_type: Endpoint +atomic_guid: + - 48117158-d7be-441b-bc6a-d9e36e47b52b mitre_attack_id: - T1059.001 - T1546.015 diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 2c50536886..7f5e5a62b2 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -2,7 +2,7 @@ name: Powershell Disable Security Monitoring id: c148a894-dd93-11eb-bf2a-acde48001122 version: 17 creation_date: '2021-07-05' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -92,6 +92,7 @@ known_false_positives: | references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell - https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1562.001/T1562.001.yaml#L328 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -114,6 +115,8 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer asset_type: Endpoint +atomic_guid: + - 6b8df440-51ec-4d53-bf83-899591c9b5d7 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/powershell_enable_powershell_remoting.yml b/detections/endpoint/powershell_enable_powershell_remoting.yml index fa068b5963..cd1f780f46 100644 --- a/detections/endpoint/powershell_enable_powershell_remoting.yml +++ b/detections/endpoint/powershell_enable_powershell_remoting.yml @@ -2,7 +2,7 @@ name: PowerShell Enable PowerShell Remoting id: 40e3b299-19a5-4460-96e9-e1467f714f8e version: 12 creation_date: '2023-03-22' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: Note that false positives may occur due to the use of the Enable-PSRemoting cmdlet by legitimate users, such as system administrators. It is recommended to apply appropriate filters as needed to minimize the number of false positives. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.006/T1021.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -43,6 +44,8 @@ intermediate_findings: analytic_story: - Malicious PowerShell asset_type: Endpoint +atomic_guid: + - 9059e8de-3d7d-4954-a322-46161880b9cf mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 1b2cd0e10c..c35197e74f 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -2,7 +2,7 @@ name: Powershell Execute COM Object id: 65711630-f9bf-11eb-8d72-acde48001122 version: 12 creation_date: '2021-08-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: network operrator may use this command. references: - https://threadreaderapp.com/thread/1423361119926816776.html - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.015/T1546.015.yaml#L58 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Hermetic Wiper - Data Destruction asset_type: Endpoint +atomic_guid: + - 752191b1-7c71-445c-9dbe-21bb031b18eb mitre_attack_id: - T1059.001 - T1546.015 diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index 62987dfb8e..fce9a2354d 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -2,7 +2,7 @@ name: PowerShell Get LocalGroup Discovery id: b71adfcc-155b-11ec-9413-acde48001122 version: 9 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -35,9 +35,12 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L33 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a580462d-2c19-4bc7-8b9a-57a41b7d3ba4 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index 979ae18953..81e3c49d6b 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -2,7 +2,7 @@ name: Powershell Get LocalGroup Discovery with Script Block Logging id: d7c6ad22-155c-11ec-bb64-acde48001122 version: 11 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,12 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L33 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a580462d-2c19-4bc7-8b9a-57a41b7d3ba4 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml index 25c23b9b49..da3bad9587 100644 --- a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml +++ b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml @@ -2,7 +2,7 @@ name: PowerShell Invoke CIMMethod CIMSession id: 651ee958-a433-471c-b264-39725b788b83 version: 12 creation_date: '2023-03-22' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: False positives may be present based on third-party applications or administrators using CIM. It is recommended to apply appropriate filters as needed to minimize the number of false positives. references: - https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/invoke-cimmethod?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml#L72 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -45,6 +46,8 @@ analytic_story: - Malicious PowerShell - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - adae83d3-0df6-45e7-b2c3-575f91584577 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 729331c475..3b69c4a75d 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -2,7 +2,7 @@ name: PowerShell Start-BitsTransfer id: 39e2605a-90d8-11eb-899e-acde48001122 version: 12 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: Limited false positives. It is possible administrators wi references: - https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 - https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -55,6 +56,8 @@ analytic_story: - BITS Jobs - Gozi Malware asset_type: Endpoint +atomic_guid: + - f63b8bc4-07e5-4112-acba-56f646f3f0bc mitre_attack_id: - T1197 product: diff --git a/detections/endpoint/powershell_start_or_stop_service.yml b/detections/endpoint/powershell_start_or_stop_service.yml index f7608d09ab..84b0b7eb74 100644 --- a/detections/endpoint/powershell_start_or_stop_service.yml +++ b/detections/endpoint/powershell_start_or_stop_service.yml @@ -2,7 +2,7 @@ name: PowerShell Start or Stop Service id: 04207f8a-e08d-4ee6-be26-1e0c4488b04a version: 12 creation_date: '2023-03-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: This behavior may be noisy, as these cmdlets are commonly references: - https://learn-powershell.net/2012/01/15/startingstopping-and-restarting-remote-services-with-powershell/ - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-service?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1543.003/T1543.003.yaml#L191 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -45,6 +46,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - 1f896ce4-8070-4959-8a25-2658856a70c9 mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 22b1972074..8b86ff9be6 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -2,7 +2,7 @@ name: Process Execution via WMI id: 24869767-8579-485d-9a4f-d9ddfd8f0cac version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -14,7 +14,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe NOT (Processes.process IN ("*\\dismhost.exe*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Although unlikely, administrators may use wmi to execute commands for legitimate purposes. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L85 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -39,6 +40,8 @@ intermediate_findings: analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 795aad1726..e4b56f2824 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -2,7 +2,7 @@ name: Registry Keys for Creating SHIM Databases id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb version: 17 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L61 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -39,6 +40,8 @@ analytic_story: - Windows Persistence Techniques - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 9b6a06f9-ab5e-4e8d-8289-1df4289db02f mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index a01367e425..8cd37e1aa5 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -2,7 +2,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b version: 35 creation_date: '2020-04-29' -modification_date: '2026-07-20' +modification_date: '2026-10-09' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\*" OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*" OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Netsh\\* OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup" OR Registry.registry_path= *\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler OR Registry.registry_path= *\\Classes\\htmlfile\\shell\\open\\command OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. known_false_positives: There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.001/T1547.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -85,6 +86,8 @@ analytic_story: - Phantom Stealer - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - e55be3fd-3521-4610-9d1a-e210e42dcf05 mitre_attack_id: - T1547.001 product: diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index e26ba5a7ae..10e5ebad02 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -2,7 +2,7 @@ name: Registry Keys Used For Privilege Escalation id: c9f4b923-f8af-4155-b697-1354f5bcbc5e version: 17 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task. references: - https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L27 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L53 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -43,6 +46,10 @@ analytic_story: - Data Destruction - Suspicious Windows Registry Activities asset_type: Endpoint +atomic_guid: + - fdda2626-5234-4c90-b163-60849a24c0b8 + - 46b1f278-c8ee-4aa5-acce-65e77b11f3c1 + - 13117939-c9b2-4a43-999e-0a543df92f0d mitre_attack_id: - T1546.012 product: diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 46996d8c89..87f0457419 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -2,7 +2,7 @@ name: Regsvr32 Silent and Install Param Dll Loading id: f421c250-24e7-11ec-bc43-acde48001122 version: 15 creation_date: '2021-10-04' -modification_date: '2026-06-09' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -40,6 +40,7 @@ known_false_positives: | references: - https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/ - https://attack.mitre.org/techniques/T1218/010/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.010/T1218.010.yaml#L133 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -72,6 +73,8 @@ analytic_story: - Remcos - Suspicious Regsvr32 Activity asset_type: Endpoint +atomic_guid: + - 9d71c492-ea2e-4c08-af16-c6994cdf029f mitre_attack_id: - T1218.010 product: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 9f27b3820a..2f1ac099df 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -2,7 +2,7 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Mauricio Velazco, Splunk status: production type: TTP @@ -36,6 +36,7 @@ known_false_positives: The wmic.exe utility is a benign Windows application. It references: - https://attack.mitre.org/techniques/T1047/ - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L103 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -66,6 +67,8 @@ analytic_story: - Active Directory Lateral Movement - Void Manticore asset_type: Endpoint +atomic_guid: + - 9c8ef159-c666-472f-9874-90c8d60d136b mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml index dd95409448..ee8f9d31a3 100644 --- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml +++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml @@ -2,7 +2,7 @@ name: Remote System Discovery with Adsisearcher id: 70803451-0047-4e12-9d63-77fa7eb8649c version: 12 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -25,6 +25,7 @@ known_false_positives: Administrators or power users may use Adsisearcher for tr references: - https://attack.mitre.org/techniques/T1018/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L359 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 64ede6ac-b57a-41c2-a7d1-32c6cd35397d mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index ff26b5ddb9..b7f9a718a6 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -2,7 +2,7 @@ name: Remote WMI Command Attempt id: 272df6de-61f1-4784-877c-1fbc3e2d0838 version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L103 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -60,6 +61,8 @@ analytic_story: - Suspicious WMI Use - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 9c8ef159-c666-472f-9874-90c8d60d136b mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index a2952ed45c..f0450790d4 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -2,7 +2,7 @@ name: Resize ShadowStorage volume id: bc760ca6-8336-11eb-bcbb-acde48001122 version: 11 creation_date: '2021-03-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras status: production type: TTP @@ -39,6 +39,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md - https://redcanary.com/blog/blackbyte-ransomware/ - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L152 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -67,6 +68,8 @@ analytic_story: - BlackByte Ransomware - VanHelsing Ransomware asset_type: Endpoint +atomic_guid: + - da558b07-69ae-41b9-b9d4-4d98154a7049 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 4ec87180d0..253a86ce92 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -2,7 +2,7 @@ name: Rundll32 Control RunDLL Hunt id: c8e7ced0-10c5-11ec-8b03-acde48001122 version: 10 creation_date: '2021-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ references: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml - https://redcanary.com/blog/intelligence-insights-december-2021/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L250 analytic_story: - Suspicious Rundll32 Activity - Microsoft MSHTML Remote Code Execution CVE-2021-40444 @@ -41,6 +42,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2021-40444 +atomic_guid: + - e4c04b6f-c492-4782-82c7-3bf75eb8077e mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 3123233083..cf0aed0643 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -2,7 +2,7 @@ name: RunDLL Loading DLL By Ordinal id: 6c135f8d-5e60-454e-80b7-c56eed739833 version: 16 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, David Dorsey, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://twitter.com/M_haggis/status/1491109262428635136 - https://twitter.com/pr0xylife/status/1590394227758104576 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L222 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -59,6 +60,8 @@ analytic_story: - Living Off The Land - IcedID asset_type: Endpoint +atomic_guid: + - 9fd5a74b-ba89-482a-8a3e-a5feaa3697b0 mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 06db197fc7..94b93cb98e 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -2,7 +2,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c version: 28 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -60,6 +60,7 @@ references: - https://www.joesandbox.com/analysis/691823/0/html - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L21 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -124,6 +125,8 @@ analytic_story: - PlugX - Remcos asset_type: Endpoint +atomic_guid: + - 42f53695-ad4a-4546-abb6-7d837f644a71 mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 5d75b6e9d9..4a5ca53c4f 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -2,7 +2,7 @@ name: Scheduled Task Initiation on Remote Endpoint id: 95cf4608-4302-11ec-8194-3e22fbd008af version: 13 creation_date: '2021-11-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk, Badoodish, Github Community status: production type: TTP @@ -35,6 +35,7 @@ known_false_positives: Administrators may start scheduled tasks on remote system references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks - https://attack.mitre.org/techniques/T1053/005/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Medusa Ransomware - Seashell Blizzard asset_type: Endpoint +atomic_guid: + - 2e5eac3e-327b-4a88-a0c0-c4057039a8dd mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 67d1e5a5b9..e8269ce232 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -2,7 +2,7 @@ name: Schtasks scheduling job on remote system id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 version: 20 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: David Dorsey, Mauricio Velazco, Splunk status: production type: TTP @@ -32,7 +32,8 @@ search: |- | `schtasks_scheduling_job_on_remote_system_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: While it is possible to have false positives, due to legitimate administrative tasks, these are usually limited and should still be validated and investigated as appropriate. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -68,6 +69,8 @@ analytic_story: - NOBELIUM Group - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 2e5eac3e-327b-4a88-a0c0-c4057039a8dd mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index f061c3f6ca..90b3694e8c 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -2,7 +2,7 @@ name: ServicePrincipalNames Discovery with SetSPN id: ae8b3efc-2d2e-11ec-8b57-acde48001122 version: 13 creation_date: '2021-10-15' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -47,6 +47,7 @@ references: - https://blog.zsec.uk/paving-2-da-wholeset/ - https://msitpros.com/?p=3113 - https://adsecurity.org/?p=3466 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L82 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - Compromised Windows Host - Active Directory Kerberos Attacks asset_type: Endpoint +atomic_guid: + - e6f4affd-d826-4871-9a62-6c9004b8fe06 mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 2c0b0f9eb9..d382049a83 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -2,7 +2,7 @@ name: Shim Database File Creation id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33 version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom* by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. known_false_positives: Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L44 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - aefd6866-d753-431f-a7a4-215ca7e3f13d mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index d7bacbc89b..cc68f93c14 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -2,7 +2,7 @@ name: Shim Database Installation With Suspicious Parameters id: 404620de-46d8-48b6-90cc-8a8d7b0876a3 version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -14,7 +14,8 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: No false positives have been identified at this time. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Persistence Techniques - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 9ab27e22-ee62-4211-962b-d36d9a0e6a18 mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index a54276b474..e645476aa6 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -2,7 +2,7 @@ name: Short Lived Windows Accounts id: b25f6f62-0782-43c1-b403-083231ffd97d version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Bhavin Patel, Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: It is possible that an administrator created and deleted references: - https://www.youtube.com/watch?v=D4Cd-KK4ctk - https://attack.mitre.org/techniques/T1078/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L68 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L91 drilldown_searches: - name: View the detection results for - "$dest$" and "$src_user$" search: '%original_detection_search% | search dest = "$dest$" src_user = "$src_user$"' @@ -57,6 +59,9 @@ analytic_story: - Active Directory Lateral Movement - GhostRedirector IIS Module and Rungan Backdoor asset_type: Windows +atomic_guid: + - 6657864e-0323-4206-9344-ac9cd7265a4f + - bc8be0ac-475c-4fbf-9b1d-9fffd77afbde mitre_attack_id: - T1078.003 - T1136.001 diff --git a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml index bb94157473..18647c0001 100644 --- a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml +++ b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml @@ -2,7 +2,7 @@ name: Steal or Forge Authentication Certificates Behavior Identified id: 87ac670e-bbfd-44ca-b566-44e9f835518d version: 9 creation_date: '2023-05-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Correlation @@ -22,6 +22,9 @@ known_false_positives: False positives may be present based on automated tooling references: - https://research.splunk.com/stories/windows_certificate_services/ - https://attack.mitre.org/techniques/T1649/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L377 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L351 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$risk_object$" search: '%original_detection_search% | search risk_object = "$risk_object$"' diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index f6d9862104..a06f18a25f 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -2,7 +2,7 @@ name: Suspicious microsoft workflow compiler usage id: 9bbc62e8-55d8-11eb-ae93-0242ac130002 version: 13 creation_date: '2021-01-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ known_false_positives: Although unlikely, limited instances have been identified references: - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L112 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -59,6 +60,8 @@ analytic_story: - Trusted Developer Utilities Proxy Execution - Living Off The Land asset_type: Endpoint +atomic_guid: + - 7cbb0f26-a4c1-4f77-b180-a009aa05637e mitre_attack_id: - T1127 product: diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index d175f3d219..abb3eb65e5 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -2,7 +2,7 @@ name: Suspicious mshta child process id: 60023bb6-5500-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Teoderick Contreras Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: Although unlikely, some legitimate applications may exhib references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +64,9 @@ analytic_story: - Lumma Stealer - MuddyWater asset_type: Endpoint +atomic_guid: + - 906865c3-e05f-4acc-85c4-fbc185455095 + - 8707a805-2b76-4f32-b1c0-14e558205772 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 36c2cd036e..f563ea52fd 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -2,7 +2,7 @@ name: Suspicious Reg exe Process id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 version: 16 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out. references: - https://car.mitre.org/wiki/CAR-2013-03-001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L39 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -68,6 +69,8 @@ analytic_story: - Disabling Security Tools - DHS Report TA18-074A asset_type: Endpoint +atomic_guid: + - c0413fb5-33e2-40b7-9b6f-60b29f4a7a18 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index 9be3b0f530..eae3bc1abe 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -2,7 +2,7 @@ name: Suspicious Rundll32 StartW id: 9319dda5-73f2-4d43-a85a-67ce961bddb7 version: 15 creation_date: '2021-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/index.htm#cshid=1036 - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/ - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L195 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -62,6 +63,8 @@ analytic_story: - Graceful Wipe Out Attack - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - ae3a8605-b26e-457c-b6b3-2702fd335bac mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index bde70a84a0..09efb091a4 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -2,7 +2,7 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f version: 22 creation_date: '2019-10-16' -modification_date: '2026-09-21' +modification_date: '2026-10-02' author: David Dorsey, Michael Haag, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -71,6 +71,7 @@ how_to_implement: |- known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -107,6 +108,8 @@ analytic_story: - Storm-0501 Ransomware - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index e762a05487..1cda3a4ce3 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -2,7 +2,7 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 version: 16 creation_date: '2020-10-14' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,9 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators debugging servers references: - https://web.archive.org/web/20210119205146/https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L95 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -50,6 +53,10 @@ analytic_story: - BlankGrabber Stealer - Lotus Blossom Chrysalis Backdoor asset_type: Windows +atomic_guid: + - 66703791-c902-4560-8770-42b8a91f7667 + - 85cfbf23-4a1e-4342-8792-007e004b975f + - 718aebaa-d0e0-471a-8241-c5afa69c7414 mitre_attack_id: - T1082 product: diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 34973c0d0a..1de08f7f7e 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -2,7 +2,7 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d version: 18 creation_date: '2019-10-16' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -43,6 +43,7 @@ known_false_positives: This detection may require tuning based on third party ap references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml - https://attack.mitre.org/techniques/T1036/003/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1036.003/T1036.003.yaml#L74 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - Windows Error Reporting Service Elevation of Privilege Vulnerability - DarkGate Malware asset_type: Endpoint +atomic_guid: + - ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa mitre_attack_id: - T1036.003 product: diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml index 92519700db..f2f2511cf5 100644 --- a/detections/endpoint/system_user_discovery_with_query.yml +++ b/detections/endpoint/system_user_discovery_with_query.yml @@ -2,7 +2,7 @@ name: System User Discovery With Query id: ad03bfcf-8a91-4bc2-a500-112993deba87 version: 9 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -34,10 +34,15 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L30 analytic_story: - Active Directory Discovery - Medusa Ransomware asset_type: Endpoint +atomic_guid: + - 4c4959bf-addf-4b4a-be86-8d09cc1857aa + - 2a9b677d-a230-44f4-ad86-782df1ef108c mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 63850b2cd6..0761ee9525 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -2,7 +2,7 @@ name: Unload Sysmon Filter Driver id: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe version: 16 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Bhavin Patel, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L236 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - CISA AA23-347A - Disabling Security Tools asset_type: Endpoint +atomic_guid: + - 811b3e76-c41b-430c-ac0d-e2380bfaa164 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell.yml b/detections/endpoint/user_discovery_with_env_vars_powershell.yml index 0d800ec0e7..57b0d50680 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell.yml @@ -2,7 +2,7 @@ name: User Discovery With Env Vars PowerShell id: 0cdf318b-a0dd-47d7-b257-c621c0247de8 version: 8 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index 70f9d59fb9..5d3c9681ab 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -2,7 +2,7 @@ name: User Discovery With Env Vars PowerShell Script Block id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20 version: 10 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -25,9 +25,12 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index c40e3ee411..634a025820 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -2,7 +2,7 @@ name: USN Journal Deletion id: b6e0ff70-b122-4227-9368-4cf322ab43c3 version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -38,6 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070/T1070.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Windows Log Manipulation - Ransomware asset_type: Endpoint +atomic_guid: + - b4115c7a-0e92-47f0-a61e-17e7218b2435 mitre_attack_id: - T1070 product: diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 5993128843..2667b4b122 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -2,7 +2,7 @@ name: WBAdmin Delete System Backups id: cd5aed7e-5cea-11eb-ae93-0242ac130002 version: 14 creation_date: '2021-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -38,6 +38,7 @@ references: - https://attack.mitre.org/techniques/T1490/ - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin - https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L108 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -61,6 +62,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 584331dd-75bc-4c02-9e0b-17f5fd81c748 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index cee3e655c7..f13ca4cd96 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -2,7 +2,7 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 version: 24 creation_date: '2022-09-05' -modification_date: '2026-08-14' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -18,6 +18,7 @@ references: - https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e - https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1134.001/T1134.001.yaml#L20 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -55,6 +56,8 @@ analytic_story: - Salat Stealer - Vidar Stealer asset_type: Endpoint +atomic_guid: + - 34f0a430-9d04-4d98-bcb5-1989f14719f0 mitre_attack_id: - T1134.002 product: diff --git a/detections/endpoint/windows_ad_dsrm_password_reset.yml b/detections/endpoint/windows_ad_dsrm_password_reset.yml index 45150fe211..7ad5873bbb 100644 --- a/detections/endpoint/windows_ad_dsrm_password_reset.yml +++ b/detections/endpoint/windows_ad_dsrm_password_reset.yml @@ -2,7 +2,7 @@ name: Windows AD DSRM Password Reset id: d1ab841c-36a6-46cf-b50f-b2b04b31182a version: 10 creation_date: '2022-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Dean Luxton status: production type: TTP @@ -22,6 +22,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Resetting the DSRM password for legitamate reasons, i.e. forgot the password. Disaster recovery. Deploying AD backdoor deliberately. references: - https://adsecurity.org/?p=1714 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml#L533 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Sneaky Active Directory Persistence Tricks - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - d5b886d9-d1c7-4b6e-a7b0-460041bf2823 mitre_attack_id: - T1098 product: diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 61a8f0b0b9..e03658266c 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -2,7 +2,7 @@ name: Windows AdFind Exe id: bd3b0187-189b-46c0-be45-f52da2bae67f version: 14 creation_date: '2020-12-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jose Hernandez, Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -66,6 +66,12 @@ references: - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption - https://www.joeware.net/freetools/tools/adfind/index.htm - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L71 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L96 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L121 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L146 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L378 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L399 drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' diff --git a/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml b/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml index f050a23a17..f592593562 100644 --- a/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml +++ b/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml @@ -2,7 +2,7 @@ name: Windows Application Whitelisting Bypass Attempt via Rundll32 id: 1ef5dab0-e1f1-495d-a272-d134583c10b1 version: 6 creation_date: '2021-02-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -65,6 +65,10 @@ references: - https://lolbas-project.github.io/lolbas/Libraries/Ieadvpack/ - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ - https://lolbas-project.github.io/lolbas/Libraries/Syssetup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L59 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L85 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L112 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L138 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -96,6 +100,11 @@ analytic_story: - Living Off The Land - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - d91cae26-7fc1-457b-a854-34c8aad48c89 + - 5e46a58e-cbf6-45ef-a289-ed7754603df9 + - 41fa324a-3946-401e-bbdd-d7991c628125 + - 71d771cd-d6b3-4f34-bc76-a63d47a10b19 mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index a0612d605f..bb97038567 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -2,7 +2,7 @@ name: Windows Attempt To Stop Security Service id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 version: 12 creation_date: '2020-04-29' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -37,6 +37,7 @@ known_false_positives: No false positives have been identified at this time. sho references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1562.001/T1562.001.yaml#L306 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +72,8 @@ analytic_story: - Azorult - Trickbot asset_type: Endpoint +atomic_guid: + - a1230893-56ac-4c81-b644-2108e982f8f5 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml index 68c633e1c8..8e479ce37e 100644 --- a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml +++ b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml @@ -2,7 +2,7 @@ name: Windows Autostart Execution LSASS Driver Registry Modification id: 57fb8656-141e-4d8a-9f51-62cff4ecb82a version: 10 creation_date: '2022-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -15,6 +15,7 @@ known_false_positives: False positives may be present on recent Windows Operatin references: - https://blog.xpnsec.com/exploring-mimikatz-part-1/ - https://github.com/oxfemale/LogonCredentialsSteal/tree/master/lsass_lib + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.008/T1547.008.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ finding: analytic_story: - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 8ecef16d-d289-46b4-917b-0dba6dc81cf1 mitre_attack_id: - T1547.008 product: diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index c9afe2a0c6..53232bd57e 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -2,7 +2,7 @@ name: Windows Binary Proxy Execution Mavinject DLL Injection id: ccf4b61b-1b26-4f2e-a089-f2009c569c57 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://attack.mitre.org/techniques/T1218/013/ - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -60,6 +61,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - c426dacf-575d-4937-8611-a148a86a5e61 mitre_attack_id: - T1218.013 product: diff --git a/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml b/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml index 8d6ee95eb7..d732490e0a 100644 --- a/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml +++ b/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml @@ -2,7 +2,7 @@ name: Windows Cabinet File Extraction Via Expand id: 4e3e3b8c-6d3a-4b47-9f5a-9e3e0a0a6f2f version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,7 @@ known_false_positives: | and sanctioned paths. references: - https://www.zscaler.com/blogs/security-research/apt37-targets-windows-rust-backdoor-and-python-loader + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L304 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +72,8 @@ analytic_story: - APT37 Rustonotto and FadeStealer - NetSupport RMM Tool Abuse asset_type: Endpoint +atomic_guid: + - 9f8b1c54-cb76-4d5e-bb1f-2f5c0e8f5a11 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml b/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml index 8dfa4e8e9e..8eb5a955e0 100644 --- a/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml +++ b/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml @@ -2,7 +2,7 @@ name: Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script id: 59a8662f-f616-4494-8fa1-29ae77fc2018 version: 2 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Raven Tait, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Certain administrative or security testing activities in Azure AD environments may use ConvertTo-AADIntBackdoor for legitimate federation configuration changes. Review and allow such actions from trusted administrators and approved tools. references: - https://atomicredteam.io/privilege-escalation/T1484.002/#atomic-test-1---add-federation-to-azure-ad + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1484.002/T1484.002.yaml#L5 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -53,6 +54,8 @@ analytic_story: - Azure Active Directory Account Takeover - Azure Active Directory Privilege Escalation asset_type: Endpoint +atomic_guid: + - 8906c5d0-3ee5-4f63-897a-f6cafd3fdbb7 mitre_attack_id: - T1482 - T1078 diff --git a/detections/endpoint/windows_create_local_account.yml b/detections/endpoint/windows_create_local_account.yml index b836178454..e19c0130d9 100644 --- a/detections/endpoint/windows_create_local_account.yml +++ b/detections/endpoint/windows_create_local_account.yml @@ -2,7 +2,7 @@ name: Windows Create Local Account id: 3fb2e8e3-7bc0-4567-9722-c5ab9f8595eb version: 13 creation_date: '2022-10-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -29,6 +29,8 @@ known_false_positives: | Restrict to critical infrastructure to reduce any volume. references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L68 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L91 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +56,9 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 6657864e-0323-4206-9344-ac9cd7265a4f + - bc8be0ac-475c-4fbf-9b1d-9fffd77afbde mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml index c424345a12..65e79e9e66 100644 --- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -2,7 +2,7 @@ name: Windows Create Local Administrator Account Via Net id: 2c568c34-bb57-4b43-9d75-19c605b98e70 version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -31,7 +31,8 @@ search: |- | `windows_create_local_administrator_account_via_net_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators often leverage net.exe to create admin accounts. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L156 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - fda74566-a604-4581-a4cc-fbbe21d66559 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml index 3b24d5c345..7003854e61 100644 --- a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml +++ b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml @@ -2,7 +2,7 @@ name: Windows Credential Dumping LSASS Memory Createdump id: b3b7ce35-fce5-4c73-85f4-700aeada81a9 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: False positives may be present if an application is dumping processes, filter as needed. Recommend reviewing createdump.exe usage across the fleet to better understand all usage and by what. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-11---dump-lsass-with-createdumpexe-from-net-v5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L308 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - Credential Dumping - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 9d0072c8-7cca-45c4-bd14-f852cfa35cf0 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index d17aeac465..fab377f7cf 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -2,7 +2,7 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 version: 22 creation_date: '2021-10-19' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -65,6 +65,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://attack.mitre.org/techniques/T1105/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L460 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -105,6 +106,8 @@ analytic_story: - Salt Typhoon - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - 2b080b99-0deb-4d51-af0f-833d37c4ca6a mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 6b6034e879..5c630ac4f3 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -2,7 +2,7 @@ name: Windows Curl Upload to Remote Destination id: 42f8f1a2-4228-11ec-aade-acde48001122 version: 18 creation_date: '2021-11-10' -modification_date: '2026-07-14' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -52,6 +52,7 @@ references: - https://everything.curl.dev/usingcurl/uploads - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 - https://twitter.com/d1r4c/status/1279042657508081664?s=20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L501 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -87,6 +88,8 @@ analytic_story: - PromptLock - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - 635c9a38-6cbf-47dc-8615-3810bc1167cf mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 9aae252470..fa335865bf 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 version: 14 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive. references: - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L260 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - Ransomware - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - d4a6da40-618f-454d-9a9e-26af552aaeb0 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index 273cf3e274..39eb28b1de 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: No false positives have been identified at this time. references: - https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ - https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L274 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 3dacb0d2-46ee-4c27-ac1b-f9886bf91a56 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 2471f81624..160d9a9755 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable LogOff Button Through Registry id: b2fb6830-9ed1-11ec-9fcb-acde48001122 version: 14 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -16,6 +16,7 @@ references: - https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774 - https://malwiki.org/index.php?title=DigiPop.xp - https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L244 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Ransomware - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - e246578a-c24d-46a7-9237-0213ff86fb0c mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index b1091f67a9..22cc088717 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -2,7 +2,7 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 version: 15 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -28,6 +28,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - CISA AA23-347A - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - c0d6d67f-1f63-42cc-95c0-5fd6b20082ad mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index a9dbf0aa07..a9d21b8e66 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -51,6 +51,7 @@ known_false_positives: |- In that scenario, filtering by the machines and users allowed to modify this registry key is recommended. references: - https://github.com/redcanaryco/atomic-red-team/blob/1ba1dd8d9ce6f74700f7aec2e60de5632f667f03/atomics/T1112/T1112.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L230 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - Ransomware - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 6e0d1131-2d7e-4905-8ca5-d6172f05d03d mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml index 904f5374cb..cc5b1ad88f 100644 --- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml +++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml @@ -2,7 +2,7 @@ name: Windows Disable Windows Event Logging Disable HTTP Logging id: 23fb6787-255f-4d5b-9a66-9fd7504032b5 version: 15 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -32,6 +32,7 @@ references: - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L27 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - a957fb0f-1e85-49b2-a211-413366784b1e mitre_attack_id: - T1505.004 - T1685.001 diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 8e2ea14afc..e39c448c01 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Windows Group Policy Features Through Registry id: 63a449ae-9f04-11ec-945e-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,6 +16,13 @@ references: - https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis - https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L288 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L318 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L333 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L348 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L363 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L378 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L393 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +44,14 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 93386d41-525c-4a1b-8235-134a628dee17 + - ffbb407e-7f1d-4c95-b22e-548169db1fbd + - a450e469-ba54-4de1-9deb-9023a6111690 + - 5e27bdb4-7fd9-455d-a2b5-4b4b22c9dea4 + - 12f50e15-dbc6-478b-a801-a746e8ba1723 + - d29b7faf-7355-4036-9ed3-719bd17951ed + - 4d72d4b1-fa7b-4374-b423-0fe326da49d2 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disableantispyware_registry.yml b/detections/endpoint/windows_disableantispyware_registry.yml index ab31e349ec..7bc79a33f8 100644 --- a/detections/endpoint/windows_disableantispyware_registry.yml +++ b/detections/endpoint/windows_disableantispyware_registry.yml @@ -2,7 +2,7 @@ name: Windows DisableAntiSpyware Registry id: 23150a40-9301-4195-b802-5bb4f43067fb version: 13 creation_date: '2020-11-06' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto, Jose Hernandez, Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. references: - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1051 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -39,6 +41,9 @@ analytic_story: - Windows Defense Evasion Tactics - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 1f6743da-6ecc-4a93-b03f-dc357e4b313f + - a72cfef8-d252-48b3-b292-635d332625c3 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index c5a13db2c6..b0f9bd96ab 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -2,7 +2,7 @@ name: Windows DISM Remove Defender id: 8567da9e-47f0-11ec-99a9-acde48001122 version: 15 creation_date: '2021-12-08' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed. references: - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L608 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - 871438ac-7d6e-432a-b27d-3e7db69faf58 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index f151287086..21e2d8dc1d 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -2,7 +2,7 @@ name: Windows DLL Search Order Hijacking Hunt with Sysmon id: 79c7d1fc-64c7-91be-a616-ccda752efe81 version: 13 creation_date: '2022-08-19' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -14,12 +14,15 @@ how_to_implement: The search is written against the latest Sysmon TA 4.0 https:/ known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed. Some applications may legitimately load libraries from non-standard paths. references: - https://hijacklibs.net + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.001/T1574.001.yaml#L67 analytic_story: - Qakbot - Windows Defense Evasion Tactics - Living Off The Land - Malicious Inno Setup Loader asset_type: Endpoint +atomic_guid: + - 65526037-7079-44a9-bda1-2cb624838040 mitre_attack_id: - T1574.001 product: diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index eee16bce84..fe022fd4bb 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -2,7 +2,7 @@ name: Windows DotNet Binary in Non Standard Path id: fddf3b56-7933-11ec-98a6-acde48001122 version: 15 creation_date: '2022-01-20' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -65,6 +65,7 @@ references: - https://attack.mitre.org/techniques/T1036/003/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1036.003/T1036.003.yaml#L74 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -99,6 +100,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa mitre_attack_id: - T1036.003 - T1218.004 diff --git a/detections/endpoint/windows_entra_user_management_via_azure_cli.yml b/detections/endpoint/windows_entra_user_management_via_azure_cli.yml index 35796b2a16..823b3c0e1d 100644 --- a/detections/endpoint/windows_entra_user_management_via_azure_cli.yml +++ b/detections/endpoint/windows_entra_user_management_via_azure_cli.yml @@ -2,7 +2,7 @@ name: Windows Entra User Management Via Azure CLI id: f6332409-abeb-42f8-b6a7-76201bdc7a0a version: 2 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Raven Tait, Splunk status: production type: Anomaly @@ -47,6 +47,7 @@ known_false_positives: Legitimate IT administrators commonly use the Azure CLI f references: - https://atomicredteam.io/persistence/T1136.003/#atomic-test-3---azure-ad---create-a-new-user-via-azure-cli - https://learn.microsoft.com/en-us/cli/azure/?view=azure-cli-latest + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.003/T1136.003.yaml#L67 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -72,6 +73,8 @@ threat_objects: analytic_story: - Azure Active Directory Persistence asset_type: Endpoint +atomic_guid: + - 228c7498-be31-48e9-83b7-9cb906504ec8 mitre_attack_id: - T1136 - T1078.004 diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index 86a7ddb47f..6271efedb5 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -2,7 +2,7 @@ name: Windows ESX Admins Group Creation via Net id: 3d7df60b-3332-4667-8090-afe03e08dce0 version: 11 creation_date: '2024-07-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505 - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.002/T1136.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2024-37085 +atomic_guid: + - fcec2963-9951-4173-9bfa-98d8b7834e62 mitre_attack_id: - T1136.002 - T1136.001 diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 62f1270f73..9998dbbd77 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -2,7 +2,7 @@ name: Windows Event Log Cleared id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a version: 21 creation_date: '2019-10-16' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -26,6 +26,7 @@ references: - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads - https://attack.mitre.org/techniques/T1070/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -50,6 +51,8 @@ analytic_story: - Clop Ransomware - Salat Stealer asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_event_logging_service_has_shutdown.yml b/detections/endpoint/windows_event_logging_service_has_shutdown.yml index d6d0895a37..db584fffad 100644 --- a/detections/endpoint/windows_event_logging_service_has_shutdown.yml +++ b/detections/endpoint/windows_event_logging_service_has_shutdown.yml @@ -2,7 +2,7 @@ name: Windows Event Logging Service Has Shutdown id: d696f622-6b08-4336-b456-696cb5b43ba0 version: 7 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -27,12 +27,17 @@ references: - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads - https://attack.mitre.org/techniques/T1070/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L149 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L170 analytic_story: - Windows Log Manipulation - Ransomware - Clop Ransomware - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 8e81d090-0cd6-4d46-863c-eec11311298f + - 85e6eff8-3ed4-4e03-ae50-aa6a404898a5 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml index 4c2862a4dd..c6c2369d6f 100644 --- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml +++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml @@ -2,7 +2,7 @@ name: Windows Event Triggered Image File Execution Options Injection id: f7abfab9-12ea-44e8-8745-475f9ca6e0a4 version: 8 creation_date: '2022-09-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -22,9 +22,12 @@ known_false_positives: False positives may be present and tuning will be require references: - https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html - https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L53 analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - 13117939-c9b2-4a43-999e-0a543df92f0d mitre_attack_id: - T1546.012 product: diff --git a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml index 836c6880c5..3a9363e33c 100644 --- a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml +++ b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml @@ -2,7 +2,7 @@ name: Windows Eventlog Cleared Via Wevtutil id: fdb829a8-db84-4832-b64b-3e964cd44f01 version: 8 creation_date: '2019-10-16' -modification_date: '2026-09-21' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -68,6 +68,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -94,6 +95,8 @@ analytic_story: - CISA AA23-347A - ShrinkLocker asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_export_certificate.yml b/detections/endpoint/windows_export_certificate.yml index fde7bd5856..2eb87319c4 100644 --- a/detections/endpoint/windows_export_certificate.yml +++ b/detections/endpoint/windows_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows Export Certificate id: d8ddfa9b-b724-4df9-9dbe-f34cc0936714 version: 11 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ how_to_implement: To implement this analytic, you must collect Microsoft-Windows known_false_positives: False positives may be generated based on an automated process or service that exports certificates on the regular. Review is required before setting to alert. Monitor for abnormal processes performing an export. references: - https://atomicredteam.io/defense-evasion/T1553.004/#atomic-test-4---install-root-ca-on-windows + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -40,6 +41,8 @@ intermediate_findings: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml index b8105a3497..1c1e9b3c7c 100644 --- a/detections/endpoint/windows_file_download_via_certutil.yml +++ b/detections/endpoint/windows_file_download_via_certutil.yml @@ -2,7 +2,7 @@ name: Windows File Download Via CertUtil id: 7fac8d40-e370-45ea-a4a3-031bbcc18b02 version: 7 creation_date: '2021-03-24' -modification_date: '2026-07-14' +modification_date: '2026-10-09' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP @@ -41,6 +41,8 @@ references: - https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L190 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L211 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -78,6 +80,9 @@ analytic_story: - CISA AA22-277A - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - dd3b61dd-7bbc-48cd-ab51-49ad1a776df0 + - ffd492e3-0455-4518-9fb1-46527c9f241b mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_file_download_via_powershell.yml b/detections/endpoint/windows_file_download_via_powershell.yml index 72f19c64fe..1139e23386 100644 --- a/detections/endpoint/windows_file_download_via_powershell.yml +++ b/detections/endpoint/windows_file_download_via_powershell.yml @@ -2,7 +2,7 @@ name: Windows File Download Via PowerShell id: 58c4e56c-b5b8-46a3-b5fb-6537dca3c6de version: 10 creation_date: '2021-03-01' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -42,6 +42,7 @@ references: - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L816 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -88,6 +89,8 @@ analytic_story: - StealC Stealer - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - c01cad7f-7a4c-49df-985e-b190dcf6a279 mitre_attack_id: - T1059.001 - T1105 diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml index f3e57138ae..0f2792ccfe 100644 --- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml +++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml @@ -2,7 +2,7 @@ name: Windows File Share Discovery With Powerview id: a44c0be1-d7ab-41e4-92fd-aa9af4fe232c version: 11 creation_date: '2023-03-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -27,6 +27,7 @@ references: - https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1 - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ - https://attack.mitre.org/techniques/T1135/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L134 drilldown_searches: - name: View the detection results for - "$dest$" and "$user_id$" search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' @@ -52,6 +53,8 @@ analytic_story: - Active Directory Privilege Escalation - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - d07e4cc1-98ae-447e-9d31-36cb430d28c4 mitre_attack_id: - T1135 product: diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml index a466d49437..6d31c42dee 100644 --- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml +++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml @@ -2,7 +2,7 @@ name: Windows Files and Dirs Access Rights Modification Via Icacls id: c76b796c-27e1-4520-91c4-4a58695c749e version: 15 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -37,6 +37,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L31 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -61,7 +62,7 @@ analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint atomic_guid: - - 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9 + - a8206bcc-f282-40a9-a389-05d9c0263485 mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml b/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml index 1a5db7d7c1..137faa5a6c 100644 --- a/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml +++ b/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml @@ -2,7 +2,7 @@ name: Windows Get-Variable.EXE Execution from WindowsApps Folder id: 7edb95b6-bccf-4d8c-8ada-d1c5520cf0ed version: 2 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,6 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some legitimate administrative tools may use custom executables in the WindowsApps folder for persistence or automation. Verify the executable's origin before flagging to avoid false positives. references: - https://thehackernews.com/2022/04/researchers-uncover-how-colibri-malware.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.008/T1574.008.yaml#L5 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - 1561de08-0b4b-498e-8261-e922f3494aae mitre_attack_id: - T1574.008 product: diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml index eb0a473e80..1e10212df4 100644 --- a/detections/endpoint/windows_group_discovery_via_net.yml +++ b/detections/endpoint/windows_group_discovery_via_net.yml @@ -2,7 +2,7 @@ name: Windows Group Discovery Via Net id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 version: 7 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Mauricio Velazco, Splunk status: production type: Hunting @@ -20,6 +20,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L21 analytic_story: - SolarWinds WHD RCE Post Exploitation - Windows Discovery Techniques @@ -35,6 +36,8 @@ analytic_story: - Volt Typhoon - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - 1f454dd6-e134-44df-bebb-67de70fb6cd8 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml b/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml index 47471c91e4..3fabe37f10 100644 --- a/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml +++ b/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml @@ -2,7 +2,7 @@ name: Windows Guest Account Enabled Via Net.EXE id: 4f8cd681-7583-47a0-9f38-6337b7adf48a version: 2 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,6 +38,8 @@ search: |- | `windows_guest_account_enabled_via_net_exe_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: The Windows guest account may be activated by IT or support teams for temporary access or troubleshooting. Filter activations related to authorized maintenance activities to reduce false alerts. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1078.001/T1078.001.yaml#L51 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -59,6 +61,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - aa6cb8c4-b582-4f8e-b677-37733914abda mitre_attack_id: - T1078.001 product: diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index b9c1505e46..7c39c7ede9 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -2,7 +2,7 @@ name: Windows HTTP Network Communication From MSIExec id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 version: 11 creation_date: '2022-06-17' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -58,6 +58,7 @@ known_false_positives: False positives will be present and filtering is required references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L309 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -90,6 +91,8 @@ analytic_story: - Cisco Network Visibility Module Analytics - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - 44a4bedf-ffe3-452e-bee4-6925ab125662 mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index e6477a71bc..fc2a6a8825 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -2,7 +2,7 @@ name: Windows Identify Protocol Handlers id: bd5c311e-a6ea-48ae-a289-19a3398e3648 version: 11 creation_date: '2022-07-12' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -38,9 +38,12 @@ references: - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479 - https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug - https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L84 analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - db020456-125b-4c8b-a4a7-487df8afb5a2 mitre_attack_id: - T1059 product: diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml index 7d94f63810..3fbc5d7fbc 100644 --- a/detections/endpoint/windows_iis_components_add_new_module.yml +++ b/detections/endpoint/windows_iis_components_add_new_module.yml @@ -2,7 +2,7 @@ name: Windows IIS Components Add New Module id: 38fe731c-1f13-43d4-b878-a5bbe44807e3 version: 14 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -36,6 +36,7 @@ references: - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - IIS Components - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 53adbdfa-8200-490c-871c-d3b1ab3324b2 mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_iis_components_new_module_added.yml b/detections/endpoint/windows_iis_components_new_module_added.yml index f23fda7fc0..e9e7758e4c 100644 --- a/detections/endpoint/windows_iis_components_new_module_added.yml +++ b/detections/endpoint/windows_iis_components_new_module_added.yml @@ -2,7 +2,7 @@ name: Windows IIS Components New Module Added id: 55f22929-cfd3-4388-ba5c-4d01fac7ee7e version: 11 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - IIS Components - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 53adbdfa-8200-490c-871c-d3b1ab3324b2 mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml index 15a6f78e8d..bfc8e823e9 100644 --- a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml +++ b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml @@ -2,7 +2,7 @@ name: Windows Impair Defenses Disable Auto Logger Session id: dc6a5613-d024-47e7-9997-ab6477a483d3 version: 9 creation_date: '2020-11-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -18,6 +18,7 @@ references: - https://isc.sans.edu/diary/rss/28628 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1201 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +38,8 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 653c6e17-14a2-4849-851d-f1c0cc8ea9ab mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml index 01a1484164..9e676c6e08 100644 --- a/detections/endpoint/windows_impair_defenses_disable_hvci.yml +++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml @@ -2,7 +2,7 @@ name: Windows Impair Defenses Disable HVCI id: b061dfcc-f0aa-42cc-a6d4-a87f172acb79 version: 11 creation_date: '2023-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives will be limited to administrative scripts disabling HVCI. Filter as needed. references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L913 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index de6a411fc9..3ba7218fe8 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -28,6 +28,7 @@ known_false_positives: Some legacy applications may be run using pcalua.exe. Sim references: - https://twitter.com/KyleHanslovan/status/912659279806640128 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Living Off The Land - Windows Post-Exploitation asset_type: Endpoint +atomic_guid: + - 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index 296099e1af..3cbdbe4f1c 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -28,6 +28,7 @@ known_false_positives: Some legacy applications may be run using pcalua.exe. Fi references: - https://twitter.com/KyleHanslovan/status/912659279806640128 - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ finding: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - cecfea7a-5f03-4cdd-8bc8-6f7c22862440 mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml index ef5bbd798f..c514963b3e 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml @@ -2,7 +2,7 @@ name: Windows Indirect Command Execution Via Series Of Forfiles id: bfdaabe7-3db8-48c5-80c1-220f9b8f22be version: 11 creation_date: '2022-12-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint +atomic_guid: + - 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml index f770c33e4d..8353103cd7 100644 --- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -2,7 +2,7 @@ name: Windows Input Capture Using Credential UI Dll id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e version: 9 creation_date: '2022-08-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -15,10 +15,13 @@ known_false_positives: this module can be loaded by a third party application. F references: - https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L16 analytic_story: - Brute Ratel C4 - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 2b162bfd-0928-4d4c-9ec3-4d9f88374b52 mitre_attack_id: - T1056.002 product: diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 9bbc67e9c5..76c2205081 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil in Non Standard Path id: dcf74b22-7933-11ec-857c-acde48001122 version: 12 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -19,6 +19,7 @@ references: - https://attack.mitre.org/techniques/T1036/003/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.004/T1218.004.yaml#L460 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 559e6d06-bb42-4307-bff7-3b95a8254bad mitre_attack_id: - T1036.003 - T1218.004 diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 9212841d13..52534c68fd 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil Uninstall Option id: cfa7b9ac-43f0-11ec-9b48-acde48001122 version: 14 creation_date: '2021-11-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -18,6 +18,7 @@ references: - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.004/T1218.004.yaml#L265 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Compromised Windows Host - Signed Binary Proxy Execution InstallUtil asset_type: Endpoint +atomic_guid: + - 34428cfa-8e38-41e5-aff4-9e1f8f3a7b4b mitre_attack_id: - T1218.004 product: diff --git a/detections/endpoint/windows_ldifde_directory_object_behavior.yml b/detections/endpoint/windows_ldifde_directory_object_behavior.yml index f6cb824804..03d828f638 100644 --- a/detections/endpoint/windows_ldifde_directory_object_behavior.yml +++ b/detections/endpoint/windows_ldifde_directory_object_behavior.yml @@ -2,7 +2,7 @@ name: Windows Ldifde Directory Object Behavior id: 35cd29ca-f08c-4489-8815-f715c45460d3 version: 12 creation_date: '2023-05-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://twitter.com/0gtweet/status/1564968845726580736?s=20 - https://strontic.github.io/xcyclopedia/library/ldifde.exe-45D28FB47E9B6ACC5DCA9FDA3E790210.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L211 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml index 68e4ad1895..87f0252f6b 100644 --- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -2,7 +2,7 @@ name: Windows Linked Policies In ADSI Discovery id: 510ea428-4731-4d2f-8829-a28293e427aa version: 11 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L247 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Active Directory Discovery - Industroyer2 asset_type: Endpoint +atomic_guid: + - 7ab0205a-34e4-4a44-9b04-e1541d1a57be mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml index 53147d54e3..710e1709cc 100644 --- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml +++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml @@ -2,7 +2,7 @@ name: Windows Mimikatz Crypto Export File Extensions id: 3a9a6806-16a8-4cda-8d73-b49d10a05b16 version: 10 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and may need to be reviewed before this can be turned into a TTP. In addition, remove .pfx (standalone) if it's too much volume. references: - https://github.com/gentilkiwi/mimikatz/blob/master/mimikatz/modules/kuhl_m_crypto.c#L628-L645 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L377 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - CISA AA23-347A - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - 290df60e-4b5d-4a5e-b0c7-dc5348ea0c86 mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml index c2284f8abb..8dcdd84b19 100644 --- a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml +++ b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry AuthenticationLevelOverride id: 6410a403-36bb-490f-a06a-11c3be7d2a41 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1061 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 7e7b62e9-5f83-477d-8935-48600f38a3c6 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml index 081b122594..d7edff1a2b 100644 --- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml +++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Auto Update Notif id: 4d1409df-40c7-4b11-aec4-bd0e709dfc12 version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L835 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,7 +34,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 335a6b15-b8d2-4a3f-a973-ad69aa2620d7 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_rdp.yml b/detections/endpoint/windows_modify_registry_disable_rdp.yml index b56ea1e175..df4afcc733 100644 --- a/detections/endpoint/windows_modify_registry_disable_rdp.yml +++ b/detections/endpoint/windows_modify_registry_disable_rdp.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable RDP id: 11ed764f-eb9c-4be7-bdad-2209b9d33ee1 version: 10 creation_date: '2024-07-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1138 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - ShrinkLocker - Windows RDP Artifacts and Defense Evasion asset_type: Endpoint +atomic_guid: + - 5f8e36de-37ca-455e-b054-a2584f043c06 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml index a0e28655d9..37ad657434 100644 --- a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Toast Notifications id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L563 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Azorult asset_type: Endpoint +atomic_guid: + - 003f466a-6010-4b15-803a-cbb478a314d7 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml index 48861e46a9..09e6f55681 100644 --- a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Win Defender Raw Write Notif id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L796 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml index da42d17dcd..906d72ca7f 100644 --- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable WinDefender Notifications id: 8e207707-ad40-4eb3-b865-3a52aec91f26 version: 12 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L796 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml index cf6e6e234c..d50a14b0a6 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Windows Security Center Notif id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L577 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 45914594-8df6-4ea9-b3cc-7eb9321a807e mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml index 101583af23..d7047f51b8 100644 --- a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml +++ b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisableRemoteDesktopAntiAlias id: 4927c6f1-4667-42e6-bd7a-f5222116386b version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L994 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 61d35188-f113-4334-8245-8c6556d43909 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml index 8bbf7c9586..1fd32a56a8 100644 --- a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml +++ b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisableSecuritySettings id: 989019b4-b7aa-418a-9a17-2293e91288b6 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1007 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - DarkGate Malware - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 4b81bcfa-fb0a-45e9-90c2-e3efe5160140 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml index afb52af6c2..c605fa982f 100644 --- a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disabling WER Settings id: 21cbcaf1-b51f-496d-a0c1-858ff3070452 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L675 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - d2c9e41e-cd86-473d-980d-b6403562e3e1 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml index fe7158b200..7f81388678 100644 --- a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisAllow Windows App id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L692 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - Azorult asset_type: Endpoint +atomic_guid: + - 71db768a-5a9c-4047-b5e7-59e01f188e84 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml index 0f7a6e5632..4fcbff8da4 100644 --- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml +++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Do Not Connect To Win Update id: e09c598e-8dd0-4e73-b740-4b96b689199e version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::DoNotConnectToWindowsUpdateInternetLocations + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L848 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - d1de3767-99c2-4c6c-8c5a-4ba4586474c8 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_dontshowui.yml b/detections/endpoint/windows_modify_registry_dontshowui.yml index d020f7be17..26351e0a9f 100644 --- a/detections/endpoint/windows_modify_registry_dontshowui.yml +++ b/detections/endpoint/windows_modify_registry_dontshowui.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DontShowUI id: 4ff9767b-fdf2-489c-83a5-c6c34412d72e version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1020 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 09147b61-40f6-4b2a-b6fb-9e73a3437c96 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml index 013437ecd0..343b7fed61 100644 --- a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml +++ b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry EnableLinkedConnections id: 93048164-3358-4af0-8680-aa5f38440516 version: 12 creation_date: '2023-07-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L126 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_longpathsenabled.yml b/detections/endpoint/windows_modify_registry_longpathsenabled.yml index cb58e89edb..ae6f6a9182 100644 --- a/detections/endpoint/windows_modify_registry_longpathsenabled.yml +++ b/detections/endpoint/windows_modify_registry_longpathsenabled.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry LongPathsEnabled id: 36f9626c-4272-4808-aadd-267acce681c0 version: 12 creation_date: '2023-07-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L126 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml index 77dae0130f..420b4c9681 100644 --- a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml +++ b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry MaxConnectionPerServer id: 064cd09f-1ff4-4823-97e0-45c2f5b087ec version: 11 creation_date: '2023-07-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://asec.ahnlab.com/en/17692/ - https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer. + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L890 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Warzone RAT asset_type: Endpoint +atomic_guid: + - 37950714-e923-4f92-8c7c-51e4b6fffbf6 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml index f99e065abb..6d6fd1e86f 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry No Auto Reboot With Logon User id: 6a12fa9f-580d-4627-8c7f-313e359bdc6a version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L822 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,7 +34,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 396f997b-c5f8-4a96-bb2c-3c8795cf459d mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml index 566ad5c946..4c332ede53 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_update.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry No Auto Update id: fbd4f333-17bb-4eab-89cb-860fa2e0600e version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L809 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 01b20ca8-c7a3-4d86-af59-059f15ed5474 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml index 9c46c0f4a7..14c926a049 100644 --- a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml +++ b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry on Smart Card Group Policy id: 1522145a-8e86-4f83-89a8-baf62a8f489d version: 9 creation_date: '2024-07-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1151 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - ShrinkLocker asset_type: Endpoint +atomic_guid: + - 4c4bf587-fe7f-448f-ba8d-1ecec9db88be mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_proxyenable.yml b/detections/endpoint/windows_modify_registry_proxyenable.yml index 792d6146df..13261230da 100644 --- a/detections/endpoint/windows_modify_registry_proxyenable.yml +++ b/detections/endpoint/windows_modify_registry_proxyenable.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry ProxyEnable id: b27f20bd-ef20-41d1-a1e9-25dedd5bf2f5 version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1034 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - eb0ba433-63e5-4a8c-a9f0-27c4192e1336 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_proxyserver.yml b/detections/endpoint/windows_modify_registry_proxyserver.yml index c94161b865..edfd77e587 100644 --- a/detections/endpoint/windows_modify_registry_proxyserver.yml +++ b/detections/endpoint/windows_modify_registry_proxyserver.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry ProxyServer id: 12bdaa0b-3c59-4489-aae1-bff6d67746ef version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1047 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - d88a3d3b-d016-4939-a745-03638aafd21b mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index 32a3377cb7..302cd984a9 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Suppress Win Defender Notif id: e3b42daf-fff4-429d-bec8-2a199468cea9 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L591 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - c30dada3-7777-4590-b970-dc890b8cf113 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index a1444c7c9f..9dcb2e5c5d 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Tamper Protection id: 12094335-88fc-4c3a-b55f-e62dd8c93c23 version: 12 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L861 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 3b625eaa-c10d-4635-af96-3eae7d2a2f3c mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 377bb7c4cf..014065e302 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -2,7 +2,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 version: 15 creation_date: '2022-03-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L498 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Windows Registry Abuse - Hermetic Wiper asset_type: Endpoint +atomic_guid: + - 795d3248-0394-4d4d-8e86-4e8df2a2693f mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index 00b2ebf2c3..28d2662d68 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -2,7 +2,7 @@ name: Windows MOF Event Triggered Execution via WMI id: e59b5a73-32bf-4467-a585-452c36ae10c1 version: 13 creation_date: '2022-07-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -20,6 +20,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp - https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ - https://www.sakshamdixit.com/wmi-events/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -50,6 +51,8 @@ analytic_story: - Living Off The Land - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index 3d5d572865..ed67803245 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -2,7 +2,7 @@ name: Windows MSIExec DLLRegisterServer id: fdb59aef-d88f-4909-8369-ec2afbd2c398 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: This analytic will need to be tuned for your environment references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L253 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -60,6 +61,8 @@ analytic_story: - Windows System Binary Proxy Execution MSIExec - Water Gamayun asset_type: Endpoint +atomic_guid: + - 0106ffa5-fab6-4c7d-82e3-e6b8867d5e5d mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index b6fc68b795..bfb1bd01bf 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -2,7 +2,7 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda version: 17 creation_date: '2022-06-17' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ known_false_positives: | references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L309 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - StealC Stealer - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - 44a4bedf-ffe3-452e-bee4-6925ab125662 mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index 5886cd3166..8d9f150a6b 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -2,7 +2,7 @@ name: Windows MSIExec Unregister DLLRegisterServer id: a27db3c5-1a9a-46df-a577-765d3f1a3c24 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: This analytic will need to be tuned for your environment references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L281 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint +atomic_guid: + - ab09ec85-4955-4f9c-b8e0-6851baf4d47f mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml index 2776bccf2e..907bc7ac7d 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -2,7 +2,7 @@ name: Windows Multiple Users Failed To Authenticate From Host Using NTLM id: 7ed272a4-9c77-11eb-af22-acde48001122 version: 13 creation_date: '2021-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -22,6 +22,7 @@ references: - https://attack.mitre.org/techniques/T1110/003/ - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1110.003/T1110.003.yaml#L55 drilldown_searches: - name: View the detection results for - "$Workstation$" search: '%original_detection_search% | search Workstation = "$Workstation$"' @@ -41,6 +42,8 @@ analytic_story: - Active Directory Password Spraying - Volt Typhoon asset_type: Endpoint +atomic_guid: + - f14d956a-5b6e-4a93-847f-0c415142f07d mitre_attack_id: - T1110.003 product: diff --git a/detections/endpoint/windows_net_system_service_discovery.yml b/detections/endpoint/windows_net_system_service_discovery.yml index db8ca969a5..78a2d60424 100644 --- a/detections/endpoint/windows_net_system_service_discovery.yml +++ b/detections/endpoint/windows_net_system_service_discovery.yml @@ -2,7 +2,7 @@ name: Windows Net System Service Discovery id: dd7da098-83b8-4c48-b09d-e51aeb621e81 version: 5 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -31,10 +31,13 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://cert.gov.ua/article/6284730 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml#L20 analytic_story: - LAMEHUG - Gh0st RAT asset_type: Endpoint +atomic_guid: + - 5f864a3f-8ce9-45c0-812c-bdf7d8aeacc3 mitre_attack_id: - T1007 product: diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml index 31f9444cb5..dc8554eb1b 100644 --- a/detections/endpoint/windows_network_share_interaction_via_net.yml +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -2,7 +2,7 @@ name: Windows Network Share Interaction Via Net id: e51fbdb0-0be0-474f-92ea-d289f71a695e version: 7 creation_date: '2024-07-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Dean Luxton status: production type: Hunting @@ -36,13 +36,16 @@ how_to_implement: The detection is based on data originating from either Endpoin known_false_positives: Administrators or power users may use this command. Additional filters needs to be applied. references: - https://attack.mitre.org/techniques/T1135/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L79 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.002/T1021.002.yaml#L5 analytic_story: - Active Directory Discovery - Active Directory Privilege Escalation - Network Discovery asset_type: Endpoint atomic_guid: - - ab39a04f-0c93-4540-9ff2-83f862c385ae + - 20f1097d-81c1-405c-8380-32174d493bbb + - 3386975b-367a-4fbb-9d77-4dcf3639ffd3 mitre_attack_id: - T1135 - T1039 diff --git a/detections/endpoint/windows_network_sniffing_tool_executed.yml b/detections/endpoint/windows_network_sniffing_tool_executed.yml index 66ede70c61..c2688a50b9 100644 --- a/detections/endpoint/windows_network_sniffing_tool_executed.yml +++ b/detections/endpoint/windows_network_sniffing_tool_executed.yml @@ -2,7 +2,7 @@ name: Windows Network Sniffing Tool Executed id: 0c594353-e12d-4867-92f6-2a1b8a1faf5f version: 1 creation_date: '2026-07-30' -modification_date: '2026-07-30' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -51,6 +51,8 @@ known_false_positives: |- Legitimate network administrators and security teams may use these tools for authorized network monitoring and troubleshooting. Filter based on approved software inventory and known administrative activity. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml#L86 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml#L154 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -80,6 +82,9 @@ analytic_story: - Windows Discovery Techniques - Network Discovery asset_type: Endpoint +atomic_guid: + - a5b2f6a0-24b4-493e-9590-c699f75723ca + - c67ba807-f48b-446e-b955-e4928cd1bf91 mitre_attack_id: - T1040 product: diff --git a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml index 7f45ca027a..428bde53f8 100644 --- a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml +++ b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml @@ -2,7 +2,7 @@ name: Windows New Custom Security Descriptor Set On EventLog Channel id: c0e5dd5a-2117-41d5-a04c-82a762a86a38 version: 9 creation_date: '2023-01-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: No false positives have been identified at this time. a l references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/set-event-log-security-locally-or-via-group-policy - https://attack.mitre.org/techniques/T1562/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L192 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -38,6 +39,8 @@ analytic_story: - LockBit Ransomware - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - a0cb81f8-44d0-4ac4-a8f3-c5c7f43a12c1 mitre_attack_id: - T1685.001 product: diff --git a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml index 34dff0237d..e8905ea4a0 100644 --- a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml +++ b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml @@ -2,7 +2,7 @@ name: Windows New EventLog ChannelAccess Registry Value Set id: 16eb11bc-ef42-42e8-9d0c-d21e0fa15725 version: 8 creation_date: '2024-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives may be triggered from newly installed eve references: - https://web.archive.org/web/20220710181255/https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness - https://attack.mitre.org/techniques/T1562/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L170 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -38,6 +39,8 @@ analytic_story: - LockBit Ransomware - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - 85e6eff8-3ed4-4e03-ae50-aa6a404898a5 mitre_attack_id: - T1685.001 product: diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index 7954dc5dcc..b91a5c4c4c 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -2,7 +2,7 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 version: 12 creation_date: '2022-01-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ known_false_positives: False positives should be limited as it is specific to Ad references: - http://www.nirsoft.net/utils/advanced_run.html - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 81ce22fd-9612-4154-918e-8a1f285d214d mitre_attack_id: - T1588.002 product: diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 41f70c1871..eb146d19cc 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -2,7 +2,7 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 version: 11 creation_date: '2022-01-24' -modification_date: '2026-09-22' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -38,10 +38,13 @@ references: - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A - http://www.nirsoft.net/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 81ce22fd-9612-4154-918e-8a1f285d214d mitre_attack_id: - T1588.002 product: diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index 9b2389e4f6..902254e559 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -2,7 +2,7 @@ name: Windows Non-System Account Targeting Lsass id: b1ce9a72-73cf-11ec-981b-acde48001122 version: 14 creation_date: '2022-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -18,6 +18,7 @@ references: - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml index c6541e4295..600ac7ab14 100644 --- a/detections/endpoint/windows_odbcconf_hunting.yml +++ b/detections/endpoint/windows_odbcconf_hunting.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Hunting id: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72 version: 9 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,14 @@ known_false_positives: False positives will be present as this is meant to assis references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L29 analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 2430498b-06c0-4b92-a448-8ad263c388e2 + - 331ce274-f9c9-440b-9f8c-a1006e1fce0b mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index c1e6eb0696..73a269d2df 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Load DLL id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present and filtering may need to references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 2430498b-06c0-4b92-a448-8ad263c388e2 mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index cfb0efbea3..9a9028cbaf 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Load Response File id: 1acafff9-1347-4b40-abae-f35aa4ba85c1 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present and filtering may need to references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L29 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 331ce274-f9c9-440b-9f8c-a1006e1fce0b mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_outlook_webview_registry_modification.yml b/detections/endpoint/windows_outlook_webview_registry_modification.yml index 8793cec91b..775ca98864 100644 --- a/detections/endpoint/windows_outlook_webview_registry_modification.yml +++ b/detections/endpoint/windows_outlook_webview_registry_modification.yml @@ -2,7 +2,7 @@ name: Windows Outlook WebView Registry Modification id: 6e1ad5d4-d9af-496a-96ec-f31c11cd09f2 version: 9 creation_date: '2024-07-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives may occur if legitimate Outlook processes references: - https://gist.github.com/MHaggis/c6318acde2e2f691b550e3a491f49ff1 - https://github.com/trustedsec/specula/wiki + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1137.004/T1137.004.yaml#L6 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Suspicious Windows Registry Activities asset_type: Endpoint +atomic_guid: + - 7a91ad51-e6d2-4d43-9471-f26362f5738e mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml index a287671fc9..d12ab3f3c1 100644 --- a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml +++ b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml @@ -2,7 +2,7 @@ name: Windows Parent PID Spoofing with Explorer id: 17f8f69c-5d00-4c88-9c6f-493bbdef20a1 version: 13 creation_date: '2022-05-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://x.com/CyberRaiju/status/1273597319322058752?s=20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1134.004/T1134.004.yaml#L90 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - cbbff285-9051-444a-9d17-c07cd2d230eb mitre_attack_id: - T1134.004 product: diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index 9d8d8f1839..c4dc611bb0 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -2,7 +2,7 @@ name: Windows Possible Credential Dumping id: e4723b92-7266-11ec-af45-acde48001122 version: 15 creation_date: '2022-01-11' -modification_date: '2026-09-08' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -60,6 +60,7 @@ references: - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1003.001_DumpLSASS/DumpLSASS.ps1 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -87,6 +88,8 @@ analytic_story: - CISA AA22-257A - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_powershell_disable_http_logging.yml b/detections/endpoint/windows_powershell_disable_http_logging.yml index 13be42e2d9..47ae84c3fc 100644 --- a/detections/endpoint/windows_powershell_disable_http_logging.yml +++ b/detections/endpoint/windows_powershell_disable_http_logging.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Disable HTTP Logging id: 27958de0-2857-43ca-9d4c-b255cf59dcab version: 13 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L27 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -47,6 +48,8 @@ analytic_story: - IIS Components - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - a957fb0f-1e85-49b2-a211-413366784b1e mitre_attack_id: - T1505.004 - T1685.001 diff --git a/detections/endpoint/windows_powershell_export_certificate.yml b/detections/endpoint/windows_powershell_export_certificate.yml index 1ca8088791..11d6e2368d 100644 --- a/detections/endpoint/windows_powershell_export_certificate.yml +++ b/detections/endpoint/windows_powershell_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Export Certificate id: 5e38ded4-c964-41f4-8cb6-4a1a53c6929f version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -27,6 +27,7 @@ known_false_positives: It is possible administrators or scripts may run these co references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ intermediate_findings: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml index 891c3a563f..d497c1abb9 100644 --- a/detections/endpoint/windows_powershell_export_pfxcertificate.yml +++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Export PfxCertificate id: ed06725f-6da6-439f-9dcc-ab30e891297c version: 14 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: It is possible administrators or scripts may run these co references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Windows Certificate Services - Water Gamayun asset_type: Endpoint +atomic_guid: + - 7617f689-bbd8-44bc-adcd-6f8968897848 mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml index d1d0f0aa91..e023cb7ee9 100644 --- a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml +++ b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Get CIMInstance Remote Computer id: d8c972eb-ed84-431a-8869-ca4bd83257d1 version: 11 creation_date: '2023-03-27' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: This is meant to be a low risk RBA anomaly analytic or to be used for hunting. Enable this with a low risk score and let it generate risk in the risk index. references: - https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1104 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ intermediate_findings: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - ac494fe5-81a4-4897-af42-e774cf005ecb mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml index 82cf168718..e81a5f975e 100644 --- a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml +++ b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml @@ -2,7 +2,7 @@ name: Windows PowerShell IIS Components WebGlobalModule Usage id: 33fc9f6f-0ce7-4696-924e-a69ec61a3d57 version: 13 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ references: - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L39 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -49,6 +50,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - IIS Components asset_type: Endpoint +atomic_guid: + - cc3381fb-4bd0-405c-a8e4-6cacfac3b06c mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index dc161addef..2a5eed3da2 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -2,7 +2,7 @@ name: Windows PowerShell ScheduleTask id: ddf82fcb-e9ee-40e3-8712-a50b5bf323fc version: 14 creation_date: '2023-06-12' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Benign administrative tasks can also trigger alerts, nece references: - https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/?view=windowsserver2022-ps - https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L78 drilldown_searches: - name: View the detection results for - "$Computer$" and "$user_id$" search: '%original_detection_search% | search Computer = "$Computer$" user_id = "$user_id$"' diff --git a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml index cbff0e938d..750c9d8558 100644 --- a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml +++ b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml @@ -2,7 +2,7 @@ name: Windows PowerView Kerberos Service Ticket Request id: 970455a1-4ac2-47e1-a9a5-9e75443ddcb9 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Gowthamaraj Rajendran, Splunk status: production type: TTP @@ -29,6 +29,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting - https://attack.mitre.org/techniques/T1558/003 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L129 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Active Directory Kerberos Attacks - Rhysida Ransomware asset_type: Endpoint +atomic_guid: + - 902f4ed2-1aba-4133-90f2-cff6d299d6da mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/windows_proxy_via_netsh.yml b/detections/endpoint/windows_proxy_via_netsh.yml index 0f29361b67..1d1515e80c 100644 --- a/detections/endpoint/windows_proxy_via_netsh.yml +++ b/detections/endpoint/windows_proxy_via_netsh.yml @@ -2,7 +2,7 @@ name: Windows Proxy Via Netsh id: c137bfe8-6036-4cff-b77b-4e327dd0a1cf version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands. references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1090.001/T1090.001.yaml#L81 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' diff --git a/detections/endpoint/windows_proxy_via_registry.yml b/detections/endpoint/windows_proxy_via_registry.yml index 23e5d18f0e..11bd729a26 100644 --- a/detections/endpoint/windows_proxy_via_registry.yml +++ b/detections/endpoint/windows_proxy_via_registry.yml @@ -2,7 +2,7 @@ name: Windows Proxy Via Registry id: 0270455b-1385-4579-9ac5-e77046c508ae version: 12 creation_date: '2023-05-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1090.001/T1090.001.yaml#L81 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_registry_bootexecute_modification.yml b/detections/endpoint/windows_registry_bootexecute_modification.yml index 4e2d65a357..c730c2797a 100644 --- a/detections/endpoint/windows_registry_bootexecute_modification.yml +++ b/detections/endpoint/windows_registry_bootexecute_modification.yml @@ -2,7 +2,7 @@ name: Windows Registry BootExecute Modification id: eabbac3a-45aa-4659-920f-6b8cff383fb8 version: 12 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and will need to be filtered. references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.001/T1547.001.yaml#L404 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - Windows BootKits asset_type: Endpoint +atomic_guid: + - 6e1666d5-3f2b-4b9a-80aa-f011322380d4 mitre_attack_id: - T1542 - T1547.001 diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index c1eb7a475b..5cd9cd3a76 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -2,7 +2,7 @@ name: Windows Registry Certificate Added id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87 version: 12 creation_date: '2022-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Teodeerick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives will be limited to a legitimate business references: - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1553.004/T1553.004.yaml#L116 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Windows Drivers - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 76f49d86-5eb1-461a-a032-a480f86652f1 mitre_attack_id: - T1553.004 product: diff --git a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml index d09656e864..fb9e911b68 100644 --- a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml +++ b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml @@ -2,7 +2,7 @@ name: Windows Registry Dotnet ETW Disabled Via ENV Variable id: 55502381-5cce-491b-9277-7cb1d10bc0df version: 11 creation_date: '2021-10-07' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -42,6 +42,10 @@ references: - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 - https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/ - https://attack.mitre.org/techniques/T1562/006/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1621 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1630 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1639 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1649 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -67,6 +71,11 @@ analytic_story: - Windows Registry Abuse - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - fdac1f79-b833-4bab-b4a1-11b1ed676a4b + - b42c1f8c-399b-47ae-8fd8-763181395fee + - 110b4281-43fe-405f-a184-5d8eaf228ebf + - 4d61779d-be7f-425c-b560-0cafb2522911 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index f5d8d1aea6..dcafbddd16 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -2,7 +2,7 @@ name: Windows Registry Modification for Safe Mode Persistence id: c6149154-c9d8-11eb-9da7-acde48001122 version: 14 creation_date: '2022-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,8 @@ references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md - https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L533 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L548 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +39,9 @@ analytic_story: - Windows Registry Abuse - Windows Drivers asset_type: Endpoint +atomic_guid: + - 1dd59fb3-1cb3-4828-805d-cf80b4c3bbb5 + - c173c948-65e5-499c-afbe-433722ed5bd4 mitre_attack_id: - T1547.001 product: diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml index 644c9a5227..9feb7c268c 100644 --- a/detections/endpoint/windows_remote_create_service.yml +++ b/detections/endpoint/windows_remote_create_service.yml @@ -2,7 +2,7 @@ name: Windows Remote Create Service id: 0dc44d03-8c00-482d-ba7c-796ba7ab18c9 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities. references: - https://attack.mitre.org/techniques/T1543/003/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1543.003/T1543.003.yaml#L145 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - CISA AA23-347A - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - fb4151a2-db33-4f8c-b7f8-78ea8790f961 mitre_attack_id: - T1543.003 product: diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index f0b4a4123e..924a74e51c 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -2,7 +2,7 @@ name: Windows Root Domain linked policies Discovery id: 80ffaede-1f12-49d5-a86e-b4b599b68b3c version: 11 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L260 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Active Directory Discovery - Industroyer2 asset_type: Endpoint +atomic_guid: + - 00c652e2-0750-4ca6-82ff-0204684a6fe4 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index 7768f86cb8..035fa47145 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -2,7 +2,7 @@ name: Windows RunMRU Command Execution id: a15aa1ab-2b79-467f-8201-65e0f32d5b1a version: 11 creation_date: '2024-11-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -17,6 +17,7 @@ references: - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 - https://www.forensafe.com/blogs/runmrukey.html - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_runmru_command_execution.yml + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L79 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml index cc80df82e7..6f28e04550 100644 --- a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml +++ b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml @@ -2,7 +2,7 @@ name: Windows ScManager Security Descriptor Tampering Via Sc.EXE id: 04023928-0381-4935-82cb-03372b2ef644 version: 9 creation_date: '2024-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/8ac5c4f84692b11ea2832d18d3dc6f1ce7fb4e41/atomics/T1569.002/T1569.002.md#atomic-test-7---modifying-acl-of-service-control-manager-via-sdet - https://0xv1n.github.io/posts/scmanager/ - https://attack.mitre.org/techniques/T1569/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L208 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ threat_objects: analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - bf07f520-3909-4ef5-aa22-877a50f2f77b mitre_attack_id: - T1569.002 product: diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml index 352d9aea29..0628f561cc 100644 --- a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -2,7 +2,7 @@ name: Windows Sensitive Group Discovery With Net id: d9eb7cda-5622-4722-bc88-7f2442f4b5af version: 9 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Anomaly @@ -33,6 +33,7 @@ references: - https://adsecurity.org/?p=3658 - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L35 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -56,6 +57,8 @@ analytic_story: - IcedID - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - 0afb5163-8181-432e-9405-4322710c0c37 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index c4d05fdf28..37af44ada5 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -2,7 +2,7 @@ name: Windows Sensitive Registry Hive Dump Via CommandLine id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e version: 11 creation_date: '2021-05-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -49,6 +49,8 @@ references: - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L176 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -85,6 +87,9 @@ analytic_story: - Windows Registry Abuse - Seashell Blizzard asset_type: Endpoint +atomic_guid: + - 5c2571d0-1572-416d-9676-812e64ca9f44 + - 21df41be-cdd8-4695-a650-c3981113aa3c mitre_attack_id: - T1003.002 product: diff --git a/detections/endpoint/windows_service_create_with_tscon.yml b/detections/endpoint/windows_service_create_with_tscon.yml index 3e5a52271b..7702b9a3d6 100644 --- a/detections/endpoint/windows_service_create_with_tscon.yml +++ b/detections/endpoint/windows_service_create_with_tscon.yml @@ -2,7 +2,7 @@ name: Windows Service Create with Tscon id: c13b3d74-6b63-4db5-a841-4206f0370077 version: 15 creation_date: '2023-03-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may arise in the RDP Hijacking analytic w references: - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1563.002/T1563.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -61,6 +62,8 @@ analytic_story: - Compromised Windows Host - Windows RDP Artifacts and Defense Evasion asset_type: Endpoint +atomic_guid: + - a37ac520-b911-458e-8aed-c5f1576d9f46 mitre_attack_id: - T1543.003 - T1563.002 diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index f2509cb3cc..6a955fbe97 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -2,7 +2,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 version: 20 creation_date: '2022-02-23' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Third party tools may used this technique to create services but not so common. references: - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.011/T1574.011.yaml#L22 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Brute Ratel C4 - Gh0st RAT asset_type: Endpoint +atomic_guid: + - f38e9eea-e1d7-4ba6-b716-584791963827 mitre_attack_id: - T1574.011 product: diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml index be8ac4dd2b..a98b4246e4 100644 --- a/detections/endpoint/windows_service_execution_remcom.yml +++ b/detections/endpoint/windows_service_execution_remcom.yml @@ -2,7 +2,7 @@ name: Windows Service Execution RemCom id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 version: 8 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,7 @@ known_false_positives: False positives may be present based on Administrative us references: - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - https://github.com/kavika13/RemCom + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L158 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -46,6 +47,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a5d8cdeb-be90-43a9-8b26-cc618deac1e0 mitre_attack_id: - T1569.002 product: diff --git a/detections/endpoint/windows_service_stop_attempt.yml b/detections/endpoint/windows_service_stop_attempt.yml index 6008781baf..800a48499c 100644 --- a/detections/endpoint/windows_service_stop_attempt.yml +++ b/detections/endpoint/windows_service_stop_attempt.yml @@ -2,7 +2,7 @@ name: Windows Service Stop Attempt id: dd0f07ea-f08f-4d88-96e5-cb58156e82b6 version: 8 creation_date: '2022-11-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Windows OS or software may stop and restart services due to some critical update. references: - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L25 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Gh0st RAT asset_type: Endpoint +atomic_guid: + - 41274289-ec9c-4213-bea4-e43c4aa57954 mitre_attack_id: - T1489 product: diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml index 62ee6a8643..7f30fc9011 100644 --- a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml +++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware File Modification Crmlog id: 27187e0e-c221-471d-a7bd-04f698985ff6 version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present as the file pattern does match legitimate files on disk. It is possible other native tools write the same file name scheme. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L208 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml index 6dd8cab6f1..58cf6a4b3c 100644 --- a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml +++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Kernel Driver Comadmin id: 628d9c7c-3242-43b5-9620-7234c080a726 version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present, filter as needed. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L110 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml index f4a4d3beb9..8b662a65d1 100644 --- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Registry Modification wav OpenWithProgIds id: 13cf8b79-805d-443c-bf52-f55bd7610dfd version: 11 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and will require tuning based on program Ids in large organizations. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L876 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml index ec9bf5438b..9417bdc3bd 100644 --- a/detections/endpoint/windows_snake_malware_service_create.yml +++ b/detections/endpoint/windows_snake_malware_service_create.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Service Create id: 64eb091f-8cab-4b41-9b09-8fb4942377df version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives should be limited as this is a strict primary indicator used by Snake Malware. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L192 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_sqlcmd_execution.yml b/detections/endpoint/windows_sqlcmd_execution.yml index 4933040903..05f388a905 100644 --- a/detections/endpoint/windows_sqlcmd_execution.yml +++ b/detections/endpoint/windows_sqlcmd_execution.yml @@ -2,7 +2,7 @@ name: Windows SQLCMD Execution id: 4e7c2f85-8f02-4bd2-a48b-5ec98a2c5f72 version: 5 creation_date: '2025-02-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -28,10 +28,13 @@ references: - https://attack.mitre.org/techniques/T1213/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md#atomic-test-32---file-download-with-sqlcmdexe - https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L900 analytic_story: - SQL Server Abuse - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 6934c16e-0b3a-4e7f-ab8c-c414acd32181 mitre_attack_id: - T1059.003 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml index f4c330f6da..88962307ce 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates CryptoAPI id: 905d5692-6d7c-432f-bc7e-a6b4f464d40e version: 10 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ how_to_implement: To implement this analytic, one will need to enable the Micros known_false_positives: False positives may be present in some instances of legitimate applications requiring to export certificates. Filter as needed. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc749296(v=ws.10) + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Windows Certificate Services - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml index 0b54ae8603..c1ba66028d 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates Export Certificate id: e39dc429-c2a5-4f1f-9c3c-6b211af6b332 version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Filtering may be requried based on automated utilities an references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ threat_objects: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml index bdddbd2124..703769f961 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates Export PfxCertificate id: 391329f3-c14b-4b8d-8b37-ac5012637360 version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Filtering may be requried based on automated utilities an references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ threat_objects: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - 7617f689-bbd8-44bc-adcd-6f8968897848 mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_subinacl_execution.yml b/detections/endpoint/windows_subinacl_execution.yml index 1618c7539e..26d5dd4564 100644 --- a/detections/endpoint/windows_subinacl_execution.yml +++ b/detections/endpoint/windows_subinacl_execution.yml @@ -2,7 +2,7 @@ name: Windows SubInAcl Execution id: 12491419-1a6f-4af4-afc3-4e2052f0610e version: 9 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -34,6 +34,7 @@ known_false_positives: No false positives have been identified at this time. sho references: - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf - https://attack.mitre.org/techniques/T1222/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L144 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - a8568b10-9ab9-4140-a523-1c72e0176924 mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 080690f079..6cd471d6f5 100644 --- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -2,7 +2,7 @@ name: Windows System Binary Proxy Execution Compiled HTML File Decompile id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d version: 15 creation_date: '2022-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://attack.mitre.org/techniques/T1218/001/ - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L191 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 20cb05e0-1fa5-406d-92c1-84da4ba01813 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml index ea161433fb..a0660e5aa9 100644 --- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml +++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml @@ -2,7 +2,7 @@ name: Windows System Network Connections Discovery Netsh id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca version: 12 creation_date: '2022-12-06' -modification_date: '2026-06-25' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -41,6 +41,7 @@ references: - https://attack.mitre.org/techniques/T1049/ - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L21 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - VIP Keylogger - Phantom Stealer asset_type: Endpoint +atomic_guid: + - 038263cb-00f4-4b0a-98ae-0696c67e1752 mitre_attack_id: - T1049 product: diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml index 6cdd11a4d4..42e84f9ed2 100644 --- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml @@ -2,7 +2,7 @@ name: Windows System Script Proxy Execution Syncappvpublishingserver id: 8dd73f89-682d-444c-8b41-8e679966ad3c version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present if the vbscript syncappvpu references: - https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1216/T1216.md#atomic-test-1---syncappvpublishingserver-signed-script-powershell-command-execution + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1216.002/T1216.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 275d963d-3f36-476c-8bef-a2a3960ee6eb mitre_attack_id: - T1216 - T1218 diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml index 0e00d65198..2d254087fe 100644 --- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml +++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml @@ -2,7 +2,7 @@ name: Windows System Time Discovery W32tm Delay id: b2cc69e7-11ba-42dc-a269-59c069a48870 version: 11 creation_date: '2022-07-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -31,6 +31,7 @@ references: - https://cert.gov.ua/article/405538 - https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1124/T1124.yaml#L42 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ intermediate_findings: analytic_story: - DarkCrystal RAT asset_type: Endpoint +atomic_guid: + - d5d5a6b0-0f92-42d8-985d-47aafa2dd4db mitre_attack_id: - T1124 product: diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml index 3e67a3b86f..94d79507ab 100644 --- a/detections/endpoint/windows_system_user_discovery_via_quser.yml +++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml @@ -2,7 +2,7 @@ name: Windows System User Discovery Via Quser id: 0c3f3e09-e47a-410e-856f-a02a5c5fafb0 version: 8 creation_date: '2022-12-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -33,11 +33,16 @@ references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L30 analytic_story: - Prestige Ransomware - Crypto Stealer - Windows Post-Exploitation asset_type: Endpoint +atomic_guid: + - 4c4959bf-addf-4b4a-be86-8d09cc1857aa + - 2a9b677d-a230-44f4-ad86-782df1ef108c mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index 3e93492d9e..72ddb7df02 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -2,7 +2,7 @@ name: Windows WMI Process Call Create id: 0661c2de-93de-11ec-9833-acde48001122 version: 9 creation_date: '2022-02-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L85 analytic_story: - Volt Typhoon - Qakbot @@ -40,6 +41,8 @@ analytic_story: - CISA AA23-347A - Cactus Ransomware asset_type: Endpoint +atomic_guid: + - b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/windows_wmi_reconnaissance_class_query.yml b/detections/endpoint/windows_wmi_reconnaissance_class_query.yml index 414b2eb0dd..5170634032 100644 --- a/detections/endpoint/windows_wmi_reconnaissance_class_query.yml +++ b/detections/endpoint/windows_wmi_reconnaissance_class_query.yml @@ -2,7 +2,7 @@ name: Windows WMI Reconnaissance Class Query id: 5e38bd3e-5da7-483d-aa61-27f7e8c27ad1 version: 3 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -64,6 +64,9 @@ how_to_implement: | known_false_positives: Administrators may execute this command for testing or auditing. references: - https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L24 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L43 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -91,6 +94,10 @@ threat_objects: analytic_story: - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - c107778c-dcf5-47c5-af2e-1d058a3df3ea + - 5750aa16-0e59-4410-8b9a-8a47ca2788e2 + - 718aebaa-d0e0-471a-8241-c5afa69c7414 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/windows_wmic_shadowcopy_delete.yml b/detections/endpoint/windows_wmic_shadowcopy_delete.yml index aad14e502b..26a3b9d0b5 100644 --- a/detections/endpoint/windows_wmic_shadowcopy_delete.yml +++ b/detections/endpoint/windows_wmic_shadowcopy_delete.yml @@ -2,7 +2,7 @@ name: Windows WMIC Shadowcopy Delete id: 0a8c4b26-a4e2-4ef1-b0d9-62af6d36bdc8 version: 5 creation_date: '2025-03-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, AJ King, Splunk status: production type: Anomaly @@ -20,6 +20,7 @@ known_false_positives: Legitimate system maintenance or backup operations may oc references: - https://any.run/malware-trends/cactus - https://attack.mitre.org/techniques/T1490/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L29 drilldown_searches: - name: View the detection results for - "$dest$" and "$process_name$" search: '%original_detection_search% | search dest = "$dest$" process_name = "$process_name$"' @@ -45,6 +46,8 @@ analytic_story: - Volt Typhoon - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 6a3ff8dd-f49c-4272-a658-11c2fe58bd88 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/windows_wmic_systeminfo_discovery.yml b/detections/endpoint/windows_wmic_systeminfo_discovery.yml index e91dc6acd9..e1c8573531 100644 --- a/detections/endpoint/windows_wmic_systeminfo_discovery.yml +++ b/detections/endpoint/windows_wmic_systeminfo_discovery.yml @@ -2,7 +2,7 @@ name: Windows Wmic Systeminfo Discovery id: 97937ece-cb13-4dbc-9684-c0dc3afd400a version: 5 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators may execute this command for testing or auditing. references: - https://cert.gov.ua/article/6284730 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L381 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - BlankGrabber Stealer - Lotus Blossom Chrysalis Backdoor asset_type: Endpoint +atomic_guid: + - 8851b73a-3624-4bf7-8704-aa312411565c mitre_attack_id: - T1082 product: diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 367735a71c..43eb55bf2d 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -2,7 +2,7 @@ name: WMI Permanent Event Subscription id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d version: 11 creation_date: '2020-04-29' -modification_date: '2026-10-05' +modification_date: '2026-10-09' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -57,6 +57,9 @@ references: - https://learn.microsoft.com/en-us/windows/win32/wmisdk/binding-an-event-filter-with-a-logical-consumer - https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer - https://learn.microsoft.com/en-us/windows/win32/wmisdk/activescripteventconsumer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 intermediate_findings: entities: - field: dest @@ -69,6 +72,10 @@ threat_objects: analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 3c64f177-28e2-49eb-a799-d767b24dd1e0 + - fecd0dfd-fb55-45fa-a10b-6250272d0832 + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 605bf5d24e..14db112d4c 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -2,7 +2,7 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 version: 13 creation_date: '2020-04-29' -modification_date: '2026-10-05' +modification_date: '2026-10-09' author: Rico Valdez, Michael Haag, Splunk status: production type: Anomaly @@ -35,6 +35,9 @@ references: - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md - https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -53,6 +56,10 @@ intermediate_findings: analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 3c64f177-28e2-49eb-a799-d767b24dd1e0 + - fecd0dfd-fb55-45fa-a10b-6250272d0832 + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index 2afa39f3c5..f8a291d67d 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -2,7 +2,7 @@ name: Wmic Group Discovery id: 83317b08-155b-11ec-8e00-acde48001122 version: 12 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L83 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - Active Directory Discovery - LAMEHUG asset_type: Endpoint +atomic_guid: + - 7413be50-be8e-430f-ad4d-07bf197884b2 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 62ae6bd88a..c3688205fd 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -2,7 +2,7 @@ name: WMIC XSL Execution via URL id: 787e9dd0-4328-11ec-a029-acde48001122 version: 14 creation_date: '2021-11-12' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -53,6 +53,7 @@ references: - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml#L126 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -84,6 +85,8 @@ analytic_story: - Suspicious WMI Use - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - 7f5be499-33be-4129-a560-66021f379b9b mitre_attack_id: - T1220 product: diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index d37e611753..5497c015bc 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -2,7 +2,7 @@ name: XSL Script Execution With WMIC id: 004e32e2-146d-11ec-a83f-acde48001122 version: 13 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://attack.mitre.org/groups/G0046/ - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml#L92 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - FIN7 - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 1b237334-3e21-4a0c-8178-b8c996124988 mitre_attack_id: - T1220 product: From a13d5f78d9dce3d006b8706783c665536eee618b Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 13 Oct 2026 12:22:57 +0200 Subject: [PATCH 155/164] Promote AI Content to Prod and Enhance it (#4287) --- .../ollama_abnormal_network_connectivity.yml | 88 +++++++++++------ .../ollama_excessive_api_requests.yml | 61 +++++++++--- ...ollama_long_running_inference_requests.yml | 97 +++++++++++++++++++ ...sible_api_endpoint_scan_reconnaissance.yml | 78 ++++++++++----- ...sible_memory_exhaustion_resource_abuse.yml | 69 ++++++++++--- .../ollama_repeated_application_errors.yml | 85 ++++++++++++++++ ...rmal_service_crash_availability_attack.yml | 14 ++- ...ssible_model_exfiltration_data_leakage.yml | 10 +- .../ollama_possible_rce_via_model_loading.yml | 13 ++- ..._suspicious_prompt_injection_jailbreak.yml | 14 ++- 10 files changed, 429 insertions(+), 100 deletions(-) create mode 100644 detections/application/ollama_long_running_inference_requests.yml create mode 100644 detections/application/ollama_repeated_application_errors.yml rename detections/{application => deprecated}/ollama_abnormal_service_crash_availability_attack.yml (90%) rename detections/{application => deprecated}/ollama_possible_model_exfiltration_data_leakage.yml (92%) rename detections/{application => deprecated}/ollama_possible_rce_via_model_loading.yml (92%) rename detections/{application => deprecated}/ollama_suspicious_prompt_injection_jailbreak.yml (90%) diff --git a/detections/application/ollama_abnormal_network_connectivity.yml b/detections/application/ollama_abnormal_network_connectivity.yml index c12fe51364..2a48c92012 100644 --- a/detections/application/ollama_abnormal_network_connectivity.yml +++ b/detections/application/ollama_abnormal_network_connectivity.yml @@ -1,54 +1,79 @@ name: Ollama Abnormal Network Connectivity id: 19ec30ad-faa2-496a-a6a9-f2e5f778fbdb -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects abnormal network activity and connectivity issues in Ollama including non-localhost API access attempts and warning-level network errors such as DNS lookup failures, TCP connection issues, or host resolution problems that may indicate network-based attacks, unauthorized access attempts, or infrastructure reconnaissance activity. +description: |- + Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance. data_source: - Ollama Server search: |- - `ollama_server` level=WARN (msg="*failed*" OR msg="*dial tcp*" OR msg="*lookup*" OR msg="*no such host*" OR msg="*connection*" OR msg="*network*" OR msg="*timeout*" OR msg="*unreachable*" OR msg="*refused*") - | eval src=coalesce(src, src_ip, "N/A") - | stats count as incidents, values(src) as src, values(msg) as warning_messages, latest(_time) as last_incident - BY host - | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S") - | eval severity="medium" - | eval attack_type="Abnormal Network Connectivity" - | stats count - BY last_incident, host, incidents, - src, warning_messages, severity, - attack_type - | `ollama_abnormal_network_connectivity_filter` -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations. + `ollama_server` + level=WARN + msg IN ( + "*connection*", + "*dial tcp*", + "*failed*", + "*lookup*", + "*network*", + "*no such host*", + "*refused*", + "*timeout*", + "*unreachable*" + ) + + | bin _time span=5m + | stats count as incidents + values(msg) as warning_messages + latest(_time) as last_incident + by _time dest + + | where incidents > 3 + + | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S") + + | eval severity="medium" + + | eval attack_type="Abnormal Network Connectivity" + + | table last_incident dest incidents warning_messages severity attack_type + + | `ollama_abnormal_network_connectivity_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + - name: View the detection results for - "$dest$" + search: |- + %original_detection_search% + | search dest="$dest$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$",) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + - name: View risk events for the last 7 days for - "$dest$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$dest$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: entities: - - field: host + - field: dest type: system score: 20 - message: 'Abnormal network activity detected on $host$ with $incidents$ incidents from $src$. Investigation needed for network errors: $warning_messages$.' -threat_objects: - - field: src - type: system + message: Abnormal network activity on [$dest$] with [$incidents$] matching warnings [$warning_messages$]. Investigate DNS and network reachability. analytic_story: - Suspicious Ollama Activities asset_type: Web Application -mitre_attack_id: - - T1571 +mitre_attack_id: [] product: - Splunk Enterprise - Splunk Enterprise Security @@ -61,5 +86,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_excessive_api_requests.yml b/detections/application/ollama_excessive_api_requests.yml index 42f4958876..76eb6313a1 100644 --- a/detections/application/ollama_excessive_api_requests.yml +++ b/detections/application/ollama_excessive_api_requests.yml @@ -1,26 +1,62 @@ name: Ollama Excessive API Requests id: 1cfab663-9adc-4169-a88c-6bae29ba3c70 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure. +description: Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines. data_source: - Ollama Server -search: '`ollama_server` | rex field=_raw "\|\s+(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\|" | eval src=coalesce(src, client_ip) | eval dest=coalesce(dest, url, uripath, endpoint) | bin _time span=5m | stats count as request_count by _time, src, dest, host | where request_count > 120 | eval severity="high" | eval attack_type="Rate Limit Abuse / DDoS" | stats count by _time, host, src, dest, request_count, severity, attack_type | `ollama_excessive_api_requests_filter`' -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. +search: |- + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) + + | bin _time span=5m + + | stats count as request_count + dc(uri_path) as distinct_endpoints + values(uri_path) as endpoints + by _time src + + | where request_count > 120 + + | eval severity="medium" + + | eval attack_type="High Volume API Activity" + + | `ollama_excessive_api_requests_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + search: |- + %original_detection_search% + | search src="$src$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -28,7 +64,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Possible DDoS attack from $src$ against Ollama server detected with request count $request_count$ in 1 minute, potentially causing service degradation or complete unavailability. + message: '[$request_count$] Ollama API requests from [$src$] across [$distinct_endpoints$] endpoints were observed in 5 minutes. Validate the client and workload before attributing the burst to abuse or service impact.' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -46,5 +82,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_long_running_inference_requests.yml b/detections/application/ollama_long_running_inference_requests.yml new file mode 100644 index 0000000000..49661c873e --- /dev/null +++ b/detections/application/ollama_long_running_inference_requests.yml @@ -0,0 +1,97 @@ +name: Ollama Long-Running Inference Requests +id: 7619c98c-f53b-445f-87ca-b148e8560340 +version: 1 +creation_date: '2026-10-09' +modification_date: '2026-10-10' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Identifies repeated Ollama inference requests with long response times on /api/generate, /api/chat, and /v1/chat/completions. + Long response time can result from model size, prompt length, host resources, or normal workload. GIN access logs do not include prompt content and cannot establish a prompt injection or jailbreak attempt, so use this as an exploratory performance signal. +data_source: + - Ollama Server +search: |- + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?(?:\d+h)?(?:\d+m)?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=mvindex(split(coalesce(uri_path, raw_path), "?"), 0) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | rex field=raw_latency "^(?:(?\d+)h)?(?:(?\d+)m)?(?[\d\.]+)(?µs|ms|s)$" + | eval response_time_ms=(coalesce(tonumber(raw_latency_hours), 0) * 3600000) + (coalesce(tonumber(raw_latency_minutes), 0) * 60000) + (tonumber(raw_latency_value) * case(raw_latency_unit="µs", 0.001, raw_latency_unit="ms", 1, raw_latency_unit="s", 1000)) + + | where isnotnull(src) AND in(uri_path, "/api/generate", "/api/chat", "/v1/chat/completions") AND response_time_ms > 30000 + + | eval response_time_seconds=response_time_ms/1000 + + | bin _time span=10m + + | stats count as long_request_count + avg(response_time_seconds) as avg_response_time + max(response_time_seconds) as max_response_time + values(uri_path) as uri_path + values(http_response_code) as status_codes + by _time src host + + | where long_request_count > 1 + + | eval avg_response_time=round(avg_response_time, 2) + | eval max_response_time=round(max_response_time, 2) + | eval severity=case(max_response_time > 55, "high", 1=1, "medium") + | eval attack_type="Long-Running Inference Requests" + + | table _time host src uri_path long_request_count + avg_response_time max_response_time + status_codes severity attack_type + + | `ollama_long_running_inference_requests_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations. +references: + - https://github.com/rosplk/ta-ollama + - https://github.com/OWASP/www-project-ai-testing-guide +drilldown_searches: + - name: View the detection results for - "$src$" + search: |- + %original_detection_search% + | search src="$src$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: '[$long_request_count$] long-running inference requests from [$src$] averaged [$avg_response_time$] seconds and reached [$max_response_time$] seconds. Investigate workload, model size, prompt length, and host capacity; access logs do not establish prompt injection or data exfiltration.' +analytic_story: + - Suspicious Ollama Activities +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log + sourcetype: ollama:server + source: server.log + test_type: unit diff --git a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml index aa1b54cd73..524253871e 100644 --- a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml +++ b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml @@ -1,38 +1,69 @@ name: Ollama Possible API Endpoint Scan Reconnaissance id: ad3f352a-0347-48ee-86b9-670b5025a548 -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. +description: |- + Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. data_source: - Ollama Server search: |- - `ollama_server` "[GIN]" - | bin _time span=5m - | stats count as total_requests, values(dest) as dest, values(http_method) as methods, values(status) as status_codes - BY _time, src, host - | where total_requests > 120 - | eval severity="medium" - | eval attack_type="API Activity Surge" - | stats count - BY _time, host, src, - total_requests, dest, methods, - status_codes, severity, attack_type - | `ollama_possible_api_endpoint_scan_reconnaissance_filter` -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations. + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) AND isnotnull(uri_path) + + | bin _time span=5m + + | stats count as total_requests + dc(uri_path) as distinct_endpoints + count(eval(http_method="HEAD")) as head_requests + values(uri_path) as endpoints + values(http_method) as methods + values(http_response_code) as status_codes + by _time src host + + | where total_requests > 120 AND (distinct_endpoints >= 3 OR (distinct_endpoints >= 2 AND head_requests > 0)) + + | eval severity="medium" + | eval attack_type="API Activity Surge" + + | table _time host src total_requests + distinct_endpoints endpoints methods + status_codes severity attack_type + + | `ollama_possible_api_endpoint_scan_reconnaissance_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + search: |- + %original_detection_search% + | search src="$src$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -40,7 +71,7 @@ intermediate_findings: - field: src type: system score: 20 - message: API reconnaissance activity detected from $src$ on $host$ with $total_requests$ requests across different endpoints using methods $methods$ and receiving status codes $status_codes$, indicating systematic endpoint enumeration to map API attack surface and identify potential vulnerabilities. + message: 'Possible API reconnaissance from [$src$] on [$host$] with [$total_requests$] requests across [$distinct_endpoints$] endpoints ([$endpoints$]) using methods [$methods$] and receiving status codes [$status_codes$].' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -58,5 +89,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml index 6b9e2b38cb..a124408fcb 100644 --- a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml +++ b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml @@ -1,26 +1,70 @@ name: Ollama Possible Memory Exhaustion Resource Abuse id: ca96297f-e82e-4749-8cc9-d1ab555abb57 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users. +description: |- + Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines. data_source: - Ollama Server -search: '`ollama_server` ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") | rex field=_raw "count=(?\d+)" | rex field=_raw "size\s*=\s*(?[\d\.]+)\s+MiB" | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" | rex field=_raw "source=(?[^\s]+)" | bin _time span=5m | stats count as operations, sum(runner_count) as total_runners, dc(code_source) as unique_sources, values(code_source) as code_sources, avg(memory_mb) as avg_memory, max(memory_mb) as max_memory, sum(memory_mb) as total_memory, avg(load_time) as avg_load_time, max(load_time) as max_load_time by _time, host | where operations > 5 OR total_runners > 0 OR max_memory > 400 OR total_memory > 500 | eval avg_memory=round(avg_memory, 2) | eval max_memory=round(max_memory, 2) | eval total_memory=round(total_memory, 2) | eval avg_load_time=round(avg_load_time, 2) | eval severity=case( max_memory > 500 OR total_memory > 1000, "critical", max_memory > 400 OR operations > 20, "high", operations > 10, "medium", 1=1, "low" ) | eval attack_type="Resource Exhaustion / Memory Abuse" | sort -_time | table _time, host, operations, total_runners, unique_sources, avg_memory, max_memory, total_memory, avg_load_time, max_load_time, severity, attack_type | `ollama_possible_memory_exhaustion_resource_abuse_filter`' -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. +search: |- + `ollama_server` + ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") + + | rex field=_raw "count=(?\d+)" + | rex field=_raw "(?[\d\.]+)\s+MiB" + | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" + | rex field=_raw "source=(?[^\s]+)" + + | bin _time span=5m + + | stats count as operations + avg(load_time) as avg_load_time + avg(memory_mb) as avg_memory + dc(code_source) as unique_sources + max(load_time) as max_load_time + max(memory_mb) as max_memory + max(runner_count) as peak_loaded_runners + values(code_source) as code_sources + by _time host + + | where operations > 10 OR peak_loaded_runners > 5 OR max_memory > 400 + + | eval avg_memory=round(avg_memory, 2) + | eval max_memory=round(max_memory, 2) + | eval avg_load_time=round(avg_load_time, 2) + | eval max_load_time=round(max_load_time, 2) + | eval severity=case(peak_loaded_runners > 10, "critical", peak_loaded_runners > 5 OR operations > 20, "high", max_memory > 400 OR operations > 10, "medium", 1=1, "low") + | eval attack_type="Resource Pressure / Memory Allocation" + + | table _time host operations peak_loaded_runners + unique_sources avg_memory max_memory + avg_load_time max_load_time severity attack_type + + | `ollama_possible_memory_exhaustion_resource_abuse_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$host$" - search: '%original_detection_search% | search "$host = "$host$"' + search: |- + %original_detection_search% + | search host="$host$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$host$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$host$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -28,7 +72,7 @@ intermediate_findings: - field: host type: system score: 20 - message: Potential resource exhaustion attack detected on $host$ with $operations$ memory operations in 5 minutes, utilizing $max_memory$ MiB peak memory and $total_runners$ runners, indicating possible attempts to exhaust system resources through excessive model loading or memory abuse. + message: 'Ollama resource pressure indicators on [$host$]: [$peak_loaded_runners$] peak loaded runners and [$max_memory$] MiB largest observed buffer across [$operations$] log events in 5 minutes. Compare with expected workloads before escalation.' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -46,5 +90,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_repeated_application_errors.yml b/detections/application/ollama_repeated_application_errors.yml new file mode 100644 index 0000000000..0dd0538dec --- /dev/null +++ b/detections/application/ollama_repeated_application_errors.yml @@ -0,0 +1,85 @@ +name: Ollama Repeated Application Errors +id: e0fff27e-ee9b-4b8d-b247-f93a93cefa71 +version: 1 +creation_date: '2026-10-09' +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Detects repeated Ollama application error events as a possible availability issue. Ollama application logs do not reliably record process termination, so this search cannot confirm a service crash without operating system or service manager telemetry. +data_source: + - Ollama Server +search: |- + `ollama_server` + (level=ERROR OR level=FATAL) + + | rex field=_raw "msg=\"(?[^\"]+)\"" + | rex field=_raw "exit_code=(?\d+)" + + | bin _time span=5m + + | stats count as error_count + earliest(_time) as first_seen + latest(_time) as last_seen + values(msg) as error_messages + values(exit_code) as exit_codes + dc(msg) as unique_errors + by _time host + + | where error_count > 1 + + | eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S") + | eval last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S") + | eval severity=case(error_count > 5, "critical", error_count > 2, "high", 1=1, "medium") + | eval attack_type="Repeated Ollama Application Errors" + + | table first_seen last_seen host error_count + unique_errors error_messages severity attack_type + + | `ollama_repeated_application_errors_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Recoverable model load failures, temporary registry or network errors, resource constraints, and other repeated application errors may trigger this exploratory signal without causing a service outage. +references: + - https://github.com/rosplk/ta-ollama +drilldown_searches: + - name: View the detection results for - "$host$" + search: |- + %original_detection_search% + | search host="$host$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$host$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: 'Repeated Ollama application errors detected on host [$host$] between [$first_seen$] and [$last_seen$]: [$error_count$] events and [$unique_errors$] unique error types. Correlate with service manager logs to determine whether availability was affected. Error messages: [$error_messages$].' +analytic_story: + - Suspicious Ollama Activities +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log + sourcetype: ollama:server + source: app.log + test_type: unit diff --git a/detections/application/ollama_abnormal_service_crash_availability_attack.yml b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml similarity index 90% rename from detections/application/ollama_abnormal_service_crash_availability_attack.yml rename to detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml index e37ebbe1b6..9c14555e32 100644 --- a/detections/application/ollama_abnormal_service_crash_availability_attack.yml +++ b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml @@ -1,10 +1,10 @@ name: Ollama Abnormal Service Crash Availability Attack id: 327fa152-9b56-4e4e-bc0b-2795d4068afa -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability. data_source: @@ -46,5 +46,9 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably. + removed_in_version: 6.12.0 + replacement_content: + - Ollama Repeated Application Errors diff --git a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml similarity index 92% rename from detections/application/ollama_possible_model_exfiltration_data_leakage.yml rename to detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml index 3140267adc..f04b73cb26 100644 --- a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml +++ b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml @@ -1,10 +1,10 @@ name: Ollama Possible Model Exfiltration Data Leakage id: c9fd1a54-0eab-4470-8970-d5fcc3c740fb -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure. data_source: @@ -48,3 +48,7 @@ tests: source: server.log test_type: experimental description: This test is a legacy experimental test and may not be accurate. +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama exfiltration detection. Access requests and response timing alone do not show what data was returned or transferred, so stronger evidence and correlation are needed. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/application/ollama_possible_rce_via_model_loading.yml b/detections/deprecated/ollama_possible_rce_via_model_loading.yml similarity index 92% rename from detections/application/ollama_possible_rce_via_model_loading.yml rename to detections/deprecated/ollama_possible_rce_via_model_loading.yml index be366b8ce8..8fdeddd5ee 100644 --- a/detections/application/ollama_possible_rce_via_model_loading.yml +++ b/detections/deprecated/ollama_possible_rce_via_model_loading.yml @@ -1,10 +1,10 @@ name: Ollama Possible RCE via Model Loading id: 3f28c930-5208-425d-a7b9-53d349756d91 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes. data_source: @@ -46,5 +46,8 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama model-loading detection. Model-loading errors alone do not confirm code execution, so the detection needs stronger evidence of execution. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml similarity index 90% rename from detections/application/ollama_suspicious_prompt_injection_jailbreak.yml rename to detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml index 3fdfeb434f..691b8187d5 100644 --- a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml +++ b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml @@ -1,10 +1,10 @@ name: Ollama Suspicious Prompt Injection Jailbreak id: aac5df6f-9151-4da6-bdb2-5691aa6e376f -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model. data_source: @@ -48,5 +48,9 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama prompt-injection detection. Long response times do not reveal prompt content or show that safeguards were bypassed, so they are not enough to identify these attacks reliably. + removed_in_version: 6.12.0 + replacement_content: + - Ollama Long-Running Inference Requests From a3936a06504da4766ee58d3cb7cd5cc6f331cdad Mon Sep 17 00:00:00 2001 From: Steve Baker Date: Tue, 13 Oct 2026 06:24:38 -0500 Subject: [PATCH 156/164] PingID credential-reset correlation: normalize usernames and handle multiple resets (#4298) --------- Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- ..._new_mfa_method_after_credential_reset.yml | 64 +++++++++++++++++-- 1 file changed, 57 insertions(+), 7 deletions(-) diff --git a/detections/application/pingid_new_mfa_method_after_credential_reset.yml b/detections/application/pingid_new_mfa_method_after_credential_reset.yml index 534ffc8cb2..7b0097d43c 100644 --- a/detections/application/pingid_new_mfa_method_after_credential_reset.yml +++ b/detections/application/pingid_new_mfa_method_after_credential_reset.yml @@ -1,17 +1,57 @@ name: PingID New MFA Method After Credential Reset id: 2fcbce12-cffa-4c84-b70c-192604d201d0 -version: 9 +version: 10 creation_date: '2023-12-20' -modification_date: '2026-05-13' +modification_date: '2026-09-29' author: Steven Dick status: production type: TTP -description: The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures. +description: |- + The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes + (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user + to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures. data_source: - PingID -search: "`pingid` \"result.message\" = \"*Device Paired*\" | rex field=result.message \"Device (Unp)?(P)?aired (?.+)\" | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = upper('actors{}.name'), reason = 'result.message' | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) | eval action=CASE(match('result.message',\"Device Paired*\"),\"created\",match('result.message', \"Device Unpaired*\"),\"deleted\") | stats count min(_time) as firstTime, max(_time) as lastTime, values(reason) as reason by src,user,action,object | join type=outer user [| search `wineventlog_security` EventID IN(4723,4724) | eval PW_Change_Time = _time, user = upper(user) | fields user,src_user,EventID,PW_Change_Time] | eval timeDiffRaw = round(lastTime - PW_Change_Time) | eval timeDiff = replace(tostring(abs(timeDiffRaw) ,\"duration\"),\"(\\d*)\\+*(\\d+):(\\d+):(\\d+)\",\"\\2 hours \\3 minutes\") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `security_content_ctime(PW_Change_Time)` | where timeDiffRaw > 0 AND timeDiffRaw < 3600 | `pingid_new_mfa_method_after_credential_reset_filter`" -how_to_implement: Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. -known_false_positives: False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration. +search: | + `pingid` + "result.message" = "*Device Paired*" + + | rex field=result.message "Device (Unp)?(P)?aired (?.+)" + | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel') + + | eval user = upper('actors{}.name') + | eval reason = 'result.message' + | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) + | eval action=CASE(match('result.message',"Device Paired*"),"created",match('result.message', "Device Unpaired*"),"deleted") + + | stats count min(_time) as firstTime, max(_time) as lastTime, values(reason) as reason by src,user,action,object + + ```Standardizes user field by removing NetBIOS and email from reported user name``` + + | eval join_user = replace(user, "^[^\x5c]*\x5c|@.*$", "") + | join type=outer max=0 join_user [ + | search `wineventlog_security` EventID IN(4723,4724) + | eval PW_Change_Time = _time + ```Standardizes user field by removing NetBIOS and email from reported user name``` + | eval join_user = replace(upper(user), "^[^\x5c]*\x5c|@.*$", "") + | fields join_user,src_user,EventID,PW_Change_Time + ] + + | eval timeDiffRaw = round(lastTime - PW_Change_Time) + | eval timeDiff = replace(tostring(abs(timeDiffRaw) ,"duration"),"(\d*)\+*(\d+):(\d+):(\d+)","\2 hours \3 minutes") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(PW_Change_Time)` + + | where timeDiffRaw > 0 AND timeDiffRaw < 3600 + | dedup src, user, action, object, lastTime sortby +timeDiffRaw + | fields - join_user + + | `pingid_new_mfa_method_after_credential_reset_filter` +how_to_implement: |- + Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. +known_false_positives: |- + False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration. references: - https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677 - https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/ @@ -28,11 +68,12 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: An MFA configuration change was detected for [$user$] within [$timeDiff$] of a password reset. The device [$object$] was $action$. + title: An MFA configuration change was detected for [$user$] within [$timeDiff$] of a password reset. The device [$object$] was [$action$]. entity: field: user type: user score: 50 +threat_objects: [] analytic_story: - Compromised User Account - Scattered Lapsus$ Hunters @@ -57,3 +98,12 @@ tests: source: PINGID sourcetype: _json test_type: unit + - name: True Positive Test - UPN usernames and multiple resets + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log + source: PINGID + sourcetype: _json + test_type: unit From 7e9ead05a777ed79dfa56c49a9fd223aba6d5509 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Tue, 13 Oct 2026 10:01:06 -0400 Subject: [PATCH 157/164] New Zeek Based Detections Migrated from SnapAttack(#4337) --------- Co-authored-by: Nasreddine Bencherchali --- data_sources/zeek_http.yml | 36 ++++++ data_sources/zeek_ssh.yml | 30 +++++ ...http_post_request_with_encoded_payload.yml | 89 +++++++++++++++ .../network/unusual_ssh_client_banner.yml | 102 +++++++++++++++++ .../web/unusual_http_request_method.yml | 104 ++++++++++++++++++ macros/zeek_http.yml | 8 ++ macros/zeek_ssh.yml | 8 ++ 7 files changed, 377 insertions(+) create mode 100644 data_sources/zeek_http.yml create mode 100644 data_sources/zeek_ssh.yml create mode 100644 detections/network/http_post_request_with_encoded_payload.yml create mode 100644 detections/network/unusual_ssh_client_banner.yml create mode 100644 detections/web/unusual_http_request_method.yml create mode 100644 macros/zeek_http.yml create mode 100644 macros/zeek_ssh.yml diff --git a/data_sources/zeek_http.yml b/data_sources/zeek_http.yml new file mode 100644 index 0000000000..23fb4433df --- /dev/null +++ b/data_sources/zeek_http.yml @@ -0,0 +1,36 @@ +name: Zeek HTTP +id: 257a3ae6-a3f6-44e0-9d10-bdc5b4f011a3 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Nasreddine Bencherchali, Splunk +description: Logs HTTP requests and responses analyzed by Zeek, including methods, URI, host, status codes, and request bodies when configured. +mitre_components: + - Network Traffic Content + - Network Traffic Flow + - Application Log Content +source: http.log +sourcetype: zeek:http +supported_TA: + - name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.11 +fields: + - id.orig_h + - id.orig_p + - id.resp_h + - id.resp_p + - method + - uri + - host + - status_code + - post_body + - user_agent +output_fields: + - id.orig_h + - id.resp_h + - id.resp_p + - uri + - method + - status_code +example_log: '{"ts": 1665164348.511363, "uid": "Ct9dph2EXJhTjowDF3", "id.orig_h": "192.168.196.131", "id.orig_p": 50050, "id.resp_h": "192.168.196.129", "id.resp_p": 80, "trans_depth": 13, "method": "POST", "host": "192.168.196.129", "uri": "/test.php", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "request_body_len": 108, "response_body_len": 0, "status_code": 200, "status_msg": "OK", "tags": [], "orig_fuids": ["FwroIQ2TSmbiOBzVz4"], "orig_mime_types": ["text/plain"], "post_body": "hMUlHTVEzmc+5fNbbspSRUEVsphYbAJ2Sy3CJZ9K12xyL1cRo1jrslMNWGGNnxbHB14R/CMybW0Z2+wOIuWtkDfKUG2IMpcOUutkDFdSiKo=", "client_header_names": ["USER-AGENT", "HOST", "CONTENT-LENGTH", "CACHE-CONTROL"], "client_header_values": ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "192.168.196.129", "108", "no-cache"], "server_header_names": ["CONTENT-TYPE", "DATE", "CONTENT-LENGTH"], "server_header_values": ["text/html", "Fri, 07 Oct 2022 17:39:09 GMT", "0"], "row_id": "dd80e4d5-b10b-4de0-bcd8-dba62c2901ea", "snapattack_session": "e50dc64e-0fc6-b1ad-429c-23ccdd5452c4"}' diff --git a/data_sources/zeek_ssh.yml b/data_sources/zeek_ssh.yml new file mode 100644 index 0000000000..4e165c3137 --- /dev/null +++ b/data_sources/zeek_ssh.yml @@ -0,0 +1,30 @@ +name: Zeek SSH +id: 9e228bf6-8c75-4d36-997c-e5ef1e1bf760 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Nasreddine Bencherchali, Splunk +description: Logs SSH handshakes analyzed by Zeek, including client and server banners and connection endpoints. +mitre_components: + - Network Traffic Content + - Network Traffic Flow +source: ssh.log +sourcetype: zeek:ssh +supported_TA: + - name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.11 +fields: + - id.orig_h + - id.orig_p + - id.resp_h + - id.resp_p + - client + - server + - uid +output_fields: + - id.orig_h + - id.resp_h + - id.resp_p + - client +example_log: '{"_path":"ssh","_write_ts":"2026-01-15T09:21:33.456789Z","ts":"2026-01-15T09:21:32.987654Z","uid":"CkLmNo2Yp3qrStUv56","id.orig_h":"192.168.20.75","id.orig_p":53874,"id.resp_h":"198.51.100.20","id.resp_p":2222,"version":2,"auth_success":true,"auth_attempts":1,"direction":"OUTBOUND","client":"SSH-2.0-SecureBlackbox","server":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","cipher_alg":"aes256-ctr","mac_alg":"hmac-sha1","compression_alg":"none","kex_alg":"diffie-hellman-group-exchange-sha256","host_key_alg":"ssh-ed25519","host_key":"11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00","remote_location.country_code":"US","remote_location.region":"MD","remote_location.city":"Baltimore","remote_location.latitude":39.2904,"remote_location.longitude":-76.6122}' diff --git a/detections/network/http_post_request_with_encoded_payload.yml b/detections/network/http_post_request_with_encoded_payload.yml new file mode 100644 index 0000000000..f05fb1a082 --- /dev/null +++ b/detections/network/http_post_request_with_encoded_payload.yml @@ -0,0 +1,89 @@ +name: HTTP POST Request with Encoded Payload +id: 0590881d-7b81-48dd-9674-1f23f7db5d40 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. + It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups. + This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads. +data_source: + - Zeek HTTP +search: |- + `zeek_http` + method="POST" + post_body="*" + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | eval _hex=if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), 1, 0) + | eval _b64=if(match(post_body, "(?:[A-Za-z0-9+/]{4}){16,}={0,2}"), 1, 0) + + | where _hex=1 OR _b64=1 + + | eval encoding_type=case(_hex=1 AND _b64=1, "Hexadecimal + Base64", _hex=1, "Hexadecimal", _b64=1, "Base64") + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(encoding_type) as encoding_type + values(post_body) as post_body + + by src dest dest_port uri method status_code + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `http_post_request_with_encoded_payload_filter` +how_to_implement: |- + Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + The "post_body" field must be populated, which requires Zeek to be configured with the HTTP post body extraction policy. + Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Legitimate applications may POST base64-encoded data, particularly APIs that transmit binary content. + Review the destination, URI, and post body content to confirm whether the activity is expected. +references: + - https://attack.mitre.org/techniques/T1071/001/ + - https://attack.mitre.org/techniques/T1132/001/ + - https://docs.zeek.org/en/master/logs/http.html +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An HTTP POST request with an encoded body of type [$encoding_type$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. +threat_objects: + - field: uri + type: uri +analytic_story: + - Command And Control + - Data Exfiltration +asset_type: Network +mitre_attack_id: + - T1071.001 + - T1132.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: network +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/http.log + sourcetype: zeek:http + source: http.log + test_type: unit diff --git a/detections/network/unusual_ssh_client_banner.yml b/detections/network/unusual_ssh_client_banner.yml new file mode 100644 index 0000000000..5bd366d59e --- /dev/null +++ b/detections/network/unusual_ssh_client_banner.yml @@ -0,0 +1,102 @@ +name: Unusual SSH Client Banner +id: 93d0f598-d65f-4c97-b030-5bb0af51a226 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. + Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement. +data_source: + - Zeek SSH +search: |- + `zeek_ssh` + client="*" + NOT client IN ( + "SSH-2.0-AsyncSSH*", + "SSH-2.0-Bitvise*", + "SSH-2.0-Cisco*", + "SSH-2.0-CyberArk*", + "SSH-2.0-dropbear*", + "SSH-2.0-FileZilla*", + "SSH-2.0-Go*", + "SSH-2.0-JSCH*", + "SSH-2.0-Juniper*", + "SSH-2.0-libssh*", + "SSH-2.0-MobaXterm*", + "SSH-2.0-OpenSSH*", + "SSH-2.0-paramiko*", + "SSH-2.0-PuTTY*", + "SSH-2.0-Renci.SshNet*", + "SSH-2.0-SecureCRT*", + "SSH-2.0-ssh2*", + "SSH-2.0-TTSSH*", + "SSH-2.0-WinSCP*", + "SSH-2.0-Xshell*" + ) + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | fillnull value=NULL + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(client) as client + values(post_body) as post_body + + by src dest dest_port + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `unusual_ssh_client_banner_filter` +how_to_implement: |- + Zeek SSH logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + The client field should be populated from the SSH handshake banner. + Configure the `zeek_ssh` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Legitimate but uncommon SSH client software not included will generate false positives. + Review the client banner and tune the filter accordingly. +references: + - https://docs.zeek.org/en/master/logs/ssh.html + - https://attack.mitre.org/techniques/T1021/004/ + - https://attack.mitre.org/techniques/T1572/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An unusual SSH client banner [$client$] was observed from [$src$] connecting to [$dest$] over port [$dest_port$]. +threat_objects: [] +analytic_story: + - Ingress Tool Transfer + - Command And Control +asset_type: Network +mitre_attack_id: + - T1021.004 + - T1572 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: network +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/ssh.log + sourcetype: zeek:ssh + source: ssh.log + test_type: unit diff --git a/detections/web/unusual_http_request_method.yml b/detections/web/unusual_http_request_method.yml new file mode 100644 index 0000000000..de65394066 --- /dev/null +++ b/detections/web/unusual_http_request_method.yml @@ -0,0 +1,104 @@ +name: Unusual HTTP Request Method +id: c086ad2b-a747-4c61-9c90-d6ffdcaefbe8 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods. + Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic. + Review the method, source, destination, and URI to assess the activity. +data_source: + - Zeek HTTP +search: |- + `zeek_http` + method=* + NOT method IN ( + "ACL", + "CCM_POST", + "CONNECT", + "COPY", + "DELETE", + "GET", + "HEAD", + "LOCK", + "MKCOL", + "MOVE", + "OPTIONS", + "PATCH", + "POST", + "PRI", + "PROPFIND", + "PROPPATCH", + "PUT", + "REPORT", + "SEARCH", + "TRACE", + "unknown", + "UNLOCK" + ) + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | stats count min(_time) as firstTime max(_time) as lastTime + values(method) as method + values(uri) as uri + values(status_code) as status_code + + by src dest dest_port + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `unusual_http_request_method_filter` +how_to_implement: |- + Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Some legitimate applications and frameworks may use non-standard HTTP methods. + Review the method and destination to determine whether the traffic is expected, then add confirmed legitimate methods to the allowlist. +references: + - https://attack.mitre.org/techniques/T1071/001/ + - https://attack.mitre.org/techniques/T1190/ + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An unusual HTTP method [$method$] ws observed from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. +threat_objects: + - field: uri + type: uri +analytic_story: + - Command And Control + - HTTP Request Smuggling +asset_type: Web Server +mitre_attack_id: + - T1071.001 + - T1190 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: web +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071/zeek_http_unusual_method/http.log + sourcetype: zeek:http + source: http.log + test_type: unit diff --git a/macros/zeek_http.yml b/macros/zeek_http.yml new file mode 100644 index 0000000000..f2428481ee --- /dev/null +++ b/macros/zeek_http.yml @@ -0,0 +1,8 @@ +name: zeek_http +id: 5deefc82-d7b0-4c6a-a9e3-fce5ebbd4291 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Splunk Threat Research Team +description: Customer specific Splunk configuration for Zeek HTTP logs. Update the sourcetype to match your environment. +definition: sourcetype="zeek:http" diff --git a/macros/zeek_ssh.yml b/macros/zeek_ssh.yml new file mode 100644 index 0000000000..090cc48ace --- /dev/null +++ b/macros/zeek_ssh.yml @@ -0,0 +1,8 @@ +name: zeek_ssh +id: 915ebcdf-ef44-4815-936a-901ee7dde6dc +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Splunk Threat Research Team +description: Customer specific Splunk configuration for Zeek SSH logs. Update the sourcetype to match your environment. +definition: sourcetype="zeek:ssh" From 6e6fe3b033317c6ba8a7c7e2317a73e734f70739 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 13 Oct 2026 10:12:01 -0700 Subject: [PATCH 158/164] Deprecated `Detect Large ICMP Traffic` Based On .conf Telemetry (#4313) --------- Co-authored-by: Nasreddine Bencherchali --- .../detect_large_icmp_traffic.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) rename detections/{network => deprecated}/detect_large_icmp_traffic.yml (95%) diff --git a/detections/network/detect_large_icmp_traffic.yml b/detections/deprecated/detect_large_icmp_traffic.yml similarity index 95% rename from detections/network/detect_large_icmp_traffic.yml rename to detections/deprecated/detect_large_icmp_traffic.yml index 98f14307a8..f491f9d89e 100644 --- a/detections/network/detect_large_icmp_traffic.yml +++ b/detections/deprecated/detect_large_icmp_traffic.yml @@ -1,10 +1,10 @@ name: Detect Large ICMP Traffic id: 9cd6d066-94d5-4ccd-a8b9-28c03ca91be8 -version: 8 +version: 9 creation_date: '2020-01-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk -status: production +status: deprecated type: TTP description: | The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. @@ -95,3 +95,7 @@ tests: source: cisco_cloud_security_addon sourcetype: cisco:cloud_security:firewall test_type: unit +deprecation_info: + reason: Detection deprecated as it is determined to be very noisy in a production environment. + removed_in_version: 6.12.0 + replacement_content: [] From 19be274d85e51352b746f703db748cd948887340 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 22:36:44 +0200 Subject: [PATCH 159/164] Automated NIST AI RMF lookup table update (#4340) --------- Co-authored-by: Nasreddine Bencherchali --- lookups/csv/detection_subcategory_map.csv | 14 ++++++-------- lookups/csv/detection_subcategory_map.yml | 2 +- .../generate_nist_ai_rmf_detection_map.py | 17 +++++++++++++++++ 3 files changed, 24 insertions(+), 9 deletions(-) diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv index 5a4b938343..25cf98922b 100644 --- a/lookups/csv/detection_subcategory_map.csv +++ b/lookups/csv/detection_subcategory_map.csv @@ -23,11 +23,9 @@ MCP,MCP Server,MCP Github Suspicious Operation,production,Hunting,Suspicious MCP MCP,MCP Server,MCP Postgres Suspicious Query,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal MCP,MCP Server,MCP Prompt Injection,production,TTP,Suspicious MCP Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal MCP,MCP Server,MCP Sensitive System File Search,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal -Ollama,Ollama Server,Ollama Abnormal Network Connectivity,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" -Ollama,Ollama Server,Ollama Abnormal Service Crash Availability Attack,experimental,Anomaly,Suspicious Ollama Activities,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal -Ollama,Ollama Server,Ollama Excessive API Requests,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal -Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" -Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal -Ollama,Ollama Server,Ollama Possible Model Exfiltration Data Leakage,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal -Ollama,Ollama Server,Ollama Possible RCE via Model Loading,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.7|Manage 4.3,high,generated_rule,AI security and resilience evaluation signal; Incident tracking or response signal -Ollama,Ollama Server,Ollama Suspicious Prompt Injection Jailbreak,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +Ollama,Ollama Server,Ollama Abnormal Network Connectivity,production,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Excessive API Requests,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Long-Running Inference Requests,production,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.4,high,generated_rule,Production AI functionality and behavior monitoring signal +Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,production,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Repeated Application Errors,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.3,high,generated_rule,Production behavior monitoring and incident/error tracking signal diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml index 01c7b156b9..dbf0a875df 100644 --- a/lookups/csv/detection_subcategory_map.yml +++ b/lookups/csv/detection_subcategory_map.yml @@ -2,7 +2,7 @@ name: detection_subcategory_map id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 version: 3 creation_date: '2026-09-02' -modification_date: '2026-10-08' +modification_date: '2026-10-13' author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team lookup_type: csv description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. diff --git a/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py index 9b651f28e6..7cf35488c1 100644 --- a/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py +++ b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py @@ -81,6 +81,16 @@ class MappingRule: ("Measure 2.4",), "Production behavior monitoring signal", ), + MappingRule( + re.compile(r"\blong[- ]running inference requests?\b", re.I), + ("Measure 2.4",), + "Production AI functionality and behavior monitoring signal", + ), + MappingRule( + re.compile(r"\brepeated (?:ollama )?application errors?\b", re.I), + ("Measure 2.4", "Manage 4.3"), + "Production behavior monitoring and incident/error tracking signal", + ), MappingRule( re.compile(r"\b(prompt injection|jailbreak|ignore previous|system prompt override|hostile prompt|sentiment)\b", re.I), ("Measure 2.6",), @@ -383,6 +393,13 @@ def main() -> int: output_changed = write_csv_if_changed(csv_content, None if args.dry_run else args.output) message = f"Generated {len(rows)} detection mappings from {len(selectors)} data source selectors." + review_rows = [row for row in rows if row["mapping_source"] == "generated_review"] + if review_rows: + message += f" {len(review_rows)} mapping(s) need manual review:" + for row in review_rows: + message += f"\n - {row['ai_system']}: {row['detection_name']} — {row['mapping_reason']}" + else: + message += " No mappings need manual review." if not args.dry_run: if output_changed and not args.no_metadata_update: new_version = bump_lookup_metadata(args.metadata, validate_modified_date(args.modified_date)) From 13bf1750b21768c03a2237ecfd27b54644bc6de9 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Wed, 14 Oct 2026 02:12:41 +0200 Subject: [PATCH 160/164] Updating Set of Nirsoft Detections (#4303) --------- Co-authored-by: Nasreddine Bencherchali --- .../detection_of_tools_built_by_nirsoft.yml | 11 +- .../possible_browser_pass_view_parameter.yml | 11 +- .../windows_nirsoft_advancedrun.yml | 9 +- ...ndows_nirsoft_tool_bundle_file_created.yml | 40 +- .../endpoint/windows_nirsoft_utilities.yml | 53 +- lookups/csv/nirsoft_utilities_lookup.csv | 592 ++++++++++++++++++ lookups/csv/nirsoft_utilities_lookup.yml | 12 + 7 files changed, 688 insertions(+), 40 deletions(-) rename detections/{endpoint => deprecated}/detection_of_tools_built_by_nirsoft.yml (92%) rename detections/{endpoint => deprecated}/possible_browser_pass_view_parameter.yml (92%) rename detections/{endpoint => deprecated}/windows_nirsoft_advancedrun.yml (95%) create mode 100644 lookups/csv/nirsoft_utilities_lookup.csv create mode 100644 lookups/csv/nirsoft_utilities_lookup.yml diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml similarity index 92% rename from detections/endpoint/detection_of_tools_built_by_nirsoft.yml rename to detections/deprecated/detection_of_tools_built_by_nirsoft.yml index c41a4a0605..2fe7690cc0 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml @@ -1,10 +1,10 @@ name: Detection of tools built by NirSoft id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Bhavin Patel, Splunk -status: experimental +status: deprecated type: Anomaly description: The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system. data_source: @@ -53,3 +53,8 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/deprecated/possible_browser_pass_view_parameter.yml similarity index 92% rename from detections/endpoint/possible_browser_pass_view_parameter.yml rename to detections/deprecated/possible_browser_pass_view_parameter.yml index 70b5aa3b1a..b21bcb9a31 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/deprecated/possible_browser_pass_view_parameter.yml @@ -1,10 +1,10 @@ name: Possible Browser Pass View Parameter id: 8ba484e8-4b97-11ec-b19a-acde48001122 -version: 8 +version: 9 creation_date: '2021-11-22' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches. data_source: @@ -35,3 +35,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/deprecated/windows_nirsoft_advancedrun.yml similarity index 95% rename from detections/endpoint/windows_nirsoft_advancedrun.yml rename to detections/deprecated/windows_nirsoft_advancedrun.yml index b91a5c4c4c..8e8fc5ffdf 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/deprecated/windows_nirsoft_advancedrun.yml @@ -1,10 +1,10 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 12 +version: 13 creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation. If malicious, this could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment. data_source: @@ -85,3 +85,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index 3d410e82b4..7e4a09118f 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -1,14 +1,13 @@ name: Windows NirSoft Tool Bundle File Created id: a2c8e8f8-18d6-4ad4-acf4-f58903bebe41 -version: 5 +version: 6 creation_date: '2025-10-24' -modification_date: '2026-05-13' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-01' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | - The following analytic detects the creation of files associated with the NirSoft - tool bundles on Windows endpoints. + The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration. The detection focuses on the creation of specific NirSoft tool bundle files, which may indicate that an attacker is preparing to use these utilities on a compromised system. Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools. @@ -20,23 +19,17 @@ search: | min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Filesystem where + FROM datamodel=Endpoint.Filesystem WHERE ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ``` + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name = "*.zip" + | table original_file_name + | rename original_file_name as Filesystem.file_name + ] - Filesystem.file_name IN ( - "brtools.zip", - "mailpv.zip", - "networktools.zip", - "passreccommandline.zip", - "passrecenc.zip", - "progtools.zip", - "rdpv.zip", - "systools.zip", - "webbrowserpassview.zip" - ) - - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product @@ -71,7 +64,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: NirSoft tool bundle file $file_name$ created on host $dest$ + message: NirSoft tool bundle file [$file_name$] created on host [$dest$]. +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path analytic_story: - Unusual Processes - Data Destruction @@ -88,7 +86,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created_new.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index eb146d19cc..5d5dd6628d 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -1,47 +1,78 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 -version: 11 +version: 12 creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk status: production -type: Hunting +type: Anomaly description: | The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise. Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes. Apply additional filtering as necessary to enhance this. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name=*.exe + | table original_file_name + | rename original_file_name as Processes.original_file_name + ] + + BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` + + | lookup local=t nirsoft_utilities_lookup original_file_name OUTPUT description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile - | search nirsoftFile=true | `windows_nirsoft_utilities_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + To successfully implement this search, ingest process creation events from your endpoints and normalize them to the Processes node of the Endpoint data model using the Splunk Common Information Model (CIM). + Ensure the normalized events populate the original_file_name field, which this search uses to identify NirSoft utilities. Supported sources might include Sysmon and CrowdStrike ProcessRollup2 when mapped to the data model. known_false_positives: False positives may be present. Filtering may be required before setting to alert. references: - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A - http://www.nirsoft.net/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: NirSoft tool [$process_name$] was executed on host [$dest$] with Command Line [$process$]. This utility [$description$]. +threat_objects: + - field: process_name + type: process_name analytic_story: - Data Destruction - WhisperGate + - Unusual Processes asset_type: Endpoint atomic_guid: - 81ce22fd-9612-4154-918e-8a1f285d214d diff --git a/lookups/csv/nirsoft_utilities_lookup.csv b/lookups/csv/nirsoft_utilities_lookup.csv new file mode 100644 index 0000000000..ba62fd11e7 --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.csv @@ -0,0 +1,592 @@ +original_file_name,description +acm.exe,"Disable/enable ActiveX components on Internet Explorer browser." +acm.zip,"ZIP Bundle for acm.exe" +AddrView.exe,"Extract URL addresses from HTML pages." +addrview.zip,"ZIP Bundle for AddrView.exe" +AdvancedRun.exe,"Run a program with different settings that you choose." +advancedrun.zip,"ZIP Bundle for AdvancedRun.exe" +AllThreadsView.exe,"Displays a list of all running threads in Windows" +allthreadsview.zip,"ZIP Bundle for AllThreadsView.exe" +AlternateStreamView.exe,"Find all hidden alternate streams stored in the file system." +alternatestreamview.zip,"ZIP Bundle for AlternateStreamView.exe" +AltStreamDump.exe,"Dumps the list of NTFS alternate streams" +altstreamdump.zip,"ZIP Bundle for AltStreamDump.exe" +AppAudioConfig.exe,"View/change audio settings of applications" +appaudioconfig.zip,"ZIP Bundle for AppAudioConfig.exe" +AppCompatibilityView.exe,"List of all programs that run with different compatibility setting" +appcompatibilityview.zip,"ZIP Bundle for AppCompatibilityView.exe" +AppCrashView.exe,"Displays the details of all application crashes occurred in your system. " +appcrashview.zip,"ZIP Bundle for AppCrashView.exe" +AppNetworkCounter.exe,"Displays number of TCP/UDP bytes and packets sent/received by every application" +appnetworkcounter.zip,"ZIP Bundle for AppNetworkCounter.exe" +AppReadWriteCounter.exe,"Displays read/write operations of every application running on your system." +appreadwritecounter.zip,"ZIP Bundle for AppReadWriteCounter.exe" +AppResourcesUsageView.exe,"View application resources usage information of Windows 10/11 " +appresourcesusageview.zip,"ZIP Bundle for AppResourcesUsageView.exe" +awatch.exe,"displays useful information about your network adapters." +awatch.zip,"ZIP Bundle for awatch.exe" +axhelper.exe,"view essential information about ActiveX components installed on your computer." +axhelper.zip,"ZIP Bundle for axhelper.exe" +BatteryHistoryView.exe,"Displays battery history information on Windows 11/10." +batteryhistoryview.zip,"ZIP Bundle for BatteryHistoryView.exe" +BatteryInfoView.exe,"Displays battery information on laptops and netbooks." +batteryinfoview.zip,"ZIP Bundle for BatteryInfoView.exe" +BlueScreenView.exe,"Show information about blue screen crashes occurred in your system." +bluescreenview.zip,"ZIP Bundle for BlueScreenView.exe" +BluetoothCL.exe,"Show bluetooth devices list" +bluetoothcl.zip,"ZIP Bundle for BluetoothCL.exe" +BluetoothLEView.exe,"Monitors the activity of Bluetooth Low Energy devices around you." +bluetoothleview.zip,"ZIP Bundle for BluetoothLEView.exe" +BluetoothLogView.exe,"Creates a log of Bluetooth activity in your area." +bluetoothlogview.zip,"ZIP Bundle for BluetoothLogView.exe" +BluetoothView.exe,"Monitors the activity of Bluetooth devices around you." +bluetoothview.zip,"ZIP Bundle for BluetoothView.exe" +BootPerformanceView.exe,"Displays the performance information of the boot process on Windows 11/10/8/7" +bootperformanceview.zip,"ZIP Bundle for BootPerformanceView.exe" +BrowserAddonsView.exe,"Displays the details of all Web browser addons/plugins installed in your system." +browseraddonsview.zip,"ZIP Bundle for BrowserAddonsView.exe" +BrowserAutoFillView.exe,"View form autofill text stored by Chrome and Firefox Web browsers" +browserautofillview.zip,"ZIP Bundle for BrowserAutoFillView.exe" +BrowserDownloadsView.exe,"Displays the details of downloaded files of Chrome and Firefox Web browsers" +browserdownloadsview.zip,"ZIP Bundle for BrowserDownloadsView.exe" +BrowsingHistoryView.exe,"View browsing history of popular Web browsers " +browsinghistoryview.zip,"ZIP Bundle for BrowsingHistoryView.exe" +brtools.zip,"ZIP Bundle for MozillaHistoryView.exe" +BulkFileChanger.exe,"Change date/time/attributes of multiple files." +bulkfilechanger.zip,"ZIP Bundle for BulkFileChanger.exe" +BulletsPassView.exe,"Reveals the passwords stored behind the bullets." +bulletspassview.zip,"ZIP Bundle for BulletsPassView.exe" +ChromeCacheView.exe,"Chrome Browser Cache Viewer" +chromecacheview.zip,"ZIP Bundle for ChromeCacheView.exe" +ChromeCookiesView.exe,"Alternative to the standard internal cookies viewer of Google Chrome" +chromecookiesview.zip,"ZIP Bundle for ChromeCookiesView.exe" +ChromeHistoryView.exe,"View the browsing history of Chrome Web browser" +chromehistoryview.zip,"ZIP Bundle for ChromeHistoryView.exe" +ChromePass.exe,"Password recovery tool for Google Chrome Web browser. " +chromepass.zip,"ZIP Bundle for ChromePass.exe" +CleanAfterMe.exe,"Clean files and Registry values in your system." +cleanafterme.zip,"ZIP Bundle for CleanAfterMe.exe" +Clipboardic.exe,"Small and simple clipboard manager." +clipboardic.zip,"ZIP Bundle for Clipboardic.exe" +ControlMyMonitor.exe,"View and modify the settings of your monitor." +controlmymonitor.zip,"ZIP Bundle for ControlMyMonitor.exe" +CountryTraceRoute.exe,"Fast Traceroute utility with IP country information." +countrytraceroute.zip,"ZIP Bundle for CountryTraceRoute.exe" +cports.exe,"Displays the list of all currently opened TCP/UDP ports on your computer." +cports.exe,"Package of network monitoring tools for Windows" +cports.zip,"ZIP Bundle for cports.exe" +CProcess.exe,"Displays the list of all processes currently running on your system." +cprocess.zip,"ZIP Bundle for CProcess.exe" +CredentialsFileView.exe,"Decrypts Credentials files of Windows." +credentialsfileview.zip,"ZIP Bundle for CredentialsFileView.exe" +CredHistView.exe,"Decrypt the CREDHIST file of Windows" +credhistview.zip,"ZIP Bundle for CredHistView.exe" +CSVFileView.exe,"CSV/Tab-delimited file viewer and converter" +csvfileview.zip,"ZIP Bundle for CSVFileView.exe" +ctie.exe,"Add/delete toolbar buttons and menu items in Internet Explorer." +ctie.zip,"ZIP Bundle for ctie.exe" +CustomExplorerToolbar.exe,"Add Copy/Cut/Paste buttons to the Explorer toolbar of Windows 7." +customexplorertoolbar.zip,"ZIP Bundle for CustomExplorerToolbar.exe" +DataProtectionDecryptor.exe,"Decrypt DPAPI-encrypted data of Windows." +dataprotectiondecryptor.zip,"ZIP Bundle for DataProtectionDecryptor.exe" +DeviceIOView.exe,"Watch the data transfer between a software or service and a device driver." +deviceioview.zip,"ZIP Bundle for DeviceIOView.exe" +DevManView.exe,"Alternative to the standard Device Manager of Windows." +devmanview.zip,"ZIP Bundle for DevManView.exe" +DHCPLogView.exe,"Displays DHCP requests sent by every device connect to your network." +dhcplogview.zip,"ZIP Bundle for DHCPLogView.exe" +Dialupass.exe,"NirSoft Dialupass utility." +dialupass.zip,"ZIP Bundle for Dialupass.exe" +DiskCountersView.exe,"Show disk drive read/write counters." +diskcountersview.zip,"ZIP Bundle for DiskCountersView.exe" +DiskSmartView.exe,"Retrieves S.M.A.R.T information from IDE/SATA disks." +disksmartview.zip,"ZIP Bundle for DiskSmartView.exe" +dllexp.exe,"Lists DLL exported functions and their memory addresses - for debugging." +dllexp.exe,"Small utilities package that can be used by programmers for debugging." +dllexp.zip,"ZIP Bundle for dllexp.exe" +DNSDataView.exe,"Retrieve the DNS records (MX, NS, A, SOA) of the specified domains. " +dnsdataview.zip,"ZIP Bundle for DNSDataView.exe" +DNSLookupView.exe,"DNS Lookup Viewer for Windows 11/10" +dnslookupview.zip,"ZIP Bundle for DNSLookupView.exe" +DNSQuerySniffer.exe,"Network sniffer utility that shows the DNS queries sent on your system. " +dnsquerysniffer.zip,"ZIP Bundle for DNSQuerySniffer.exe" +DomainHostingView.exe,"Displays extensive information about a domain." +DomainHostingView.exe,"Package of domain/ip address lookup tools for Windows" +domainhostingview.zip,"ZIP Bundle for DomainHostingView.exe" +domainlookuptools.zip,"ZIP Bundle for DomainHostingView.exe" +DotNetResourcesExtract.exe,"Extract embedded resources from .NET applications." +dotnetresourcesextract.zip,"ZIP Bundle for DotNetResourcesExtract.exe" +DownTester.exe,"Test your Internet download speed." +downtester.zip,"ZIP Bundle for DownTester.exe" +DriveLetterView.exe,"View and change drive letter assignments " +driveletterview.zip,"ZIP Bundle for DriveLetterView.exe" +DriverView.exe,"Displays the list of all device drivers currently loaded on your system." +driverview.zip,"ZIP Bundle for DriverView.exe" +DumpEDID.exe,"Dump EDID information into the console window." +dumpedid.zip,"ZIP Bundle for DumpEDID.exe" +EdgeCookiesView.exe,"Display cookies from new versions of MS-Edge" +edgecookiesview.zip,"ZIP Bundle for EdgeCookiesView.exe" +EncryptedRegView.exe,"Scans the Registry and decrypts the data encrypted with DPAPI." +encryptedregview.zip,"ZIP Bundle for EncryptedRegView.exe" +ESEDatabaseView.exe,"View the content of ESE database files (.edb files)" +esedatabaseview.zip,"ZIP Bundle for ESEDatabaseView.exe" +EventLogChannelsView.exe,"View, Disable, Enable Event Log Channels." +eventlogchannelsview.zip,"ZIP Bundle for EventLogChannelsView.exe" +EventLogSourcesView.exe,"Displays the list of all event log sources installed on your system. " +eventlogsourcesview.zip,"ZIP Bundle for EventLogSourcesView.exe" +ExecutedProgramsList.exe,"Displays programs and batch files that you previously executed on your system." +executedprogramslist.zip,"ZIP Bundle for ExecutedProgramsList.exe" +ExifDataView.exe,"Displays the Exif data stored inside .jpg image files" +exifdataview.zip,"ZIP Bundle for ExifDataView.exe" +ExtPassword.exe,"External Drive Password Recovery" +extpassword.zip,"ZIP Bundle for ExtPassword.exe" +FastResolver.exe,"Resolves multiple host names into IP addresses/MAC Addresses and vice versa. " +fastresolver.zip,"ZIP Bundle for FastResolver.exe" +faview.exe,"displays the list of all your Favorties/bookmarks in a single page." +faview.zip,"ZIP Bundle for faview.exe" +FBCacheView.exe,"Shows Facebook images stored in the cache of your Web browser." +fbcacheview.zip,"ZIP Bundle for FBCacheView.exe" +FileAccessErrorView.exe,"Displays file access error information" +fileaccesserrorview.zip,"ZIP Bundle for FileAccessErrorView.exe" +FileActivityWatch.exe,"Displays information about read/write/delete operations on your system." +fileactivitywatch.zip,"ZIP Bundle for FileActivityWatch.exe" +FileTypesMan.exe,"Alternative to the File Types manager of Windows." +filetypesman.zip,"ZIP Bundle for FileTypesMan.exe" +FirefoxDownloadsView.exe,"Displayed the list of downloaded files in Firefox" +firefoxdownloadsview.zip,"ZIP Bundle for FirefoxDownloadsView.exe" +FirmwareTablesView.exe,"Displays a list of firmware tables (ACPI, SMBIOS) stored on your system." +firmwaretablesview.zip,"ZIP Bundle for FirmwareTablesView.exe" +FlashCookiesView.exe,"View Flash cookies stored in your computer." +flashcookiesview.zip,"ZIP Bundle for FlashCookiesView.exe" +FolderChangesView.exe,"Monitor folder/drive changes." +folderchangesview.zip,"ZIP Bundle for FolderChangesView.exe" +FolderTimeUpdate.exe,"Updates the Modified Time of folders." +foldertimeupdate.zip,"ZIP Bundle for FolderTimeUpdate.exe" +folrep.exe,"Scans your disk, and displays a report about each folder." +folrep.zip,"ZIP Bundle for folrep.exe" +FreeSpaceLogView.exe,"View log of free disk space on Windows" +freespacelogview.zip,"ZIP Bundle for FreeSpaceLogView.exe" +FullEventLogView.exe,"Event log viewer for Windows 10/8/7/Vista." +fulleventlogview.zip,"ZIP Bundle for FullEventLogView.exe" +FullUpdatesHistoryView.exe,"Displays the history of Windows 11 updates on your system. " +fullupdateshistoryview.zip,"ZIP Bundle for FullUpdatesHistoryView.exe" +gacview.exe,"Alternative to the standard .NET assembly viewer on Windows Explorer." +gacview.zip,"ZIP Bundle for gacview.exe" +GDIView.exe,"Displays the list of GDI handles opened by every process" +gdiview.zip,"ZIP Bundle for GDIView.exe" +GetNir.exe,"Command line tool to extract values from tab-delimited and comma-delimited data" +getnir.zip,"ZIP Bundle for GetNir.exe" +GUIPropView.exe,"Displays extensive information about all windows currently opened on your system" +guipropview.zip,"ZIP Bundle for GUIPropView.exe" +HandleCountersView.exe,"Shows handle counter for every process" +handlecountersview.zip,"ZIP Bundle for HandleCountersView.exe" +HashMyFiles.exe,"Calculate the MD5/SHA1 hashes of your files" +hashmyfiles.zip,"ZIP Bundle for HashMyFiles.exe" +HeapMemView.exe,"View the content of all memory blocks allocated in the heap." +heapmemview.zip,"ZIP Bundle for HeapMemView.exe" +HostedNetworkStarter.exe,"Create a wifi hotspot with your wireless network adapter" +hostednetworkstarter.zip,"ZIP Bundle for HostedNetworkStarter.exe" +HotKeysList.exe,"Displays the list of hot keys that are currently registered on your system." +hotkeyslist.zip,"ZIP Bundle for HotKeysList.exe" +HtmlAsText.exe,"Converts HTML documents to simple text files." +htmlastext.zip,"ZIP Bundle for HtmlAsText.exe" +HtmlDocEdit.exe,"Simple HTML designer/editor" +htmldocedit.zip,"ZIP Bundle for HtmlDocEdit.exe" +HTTPNetworkSniffer.exe,"Captures and displays HTTP requests/responses." +httpnetworksniffer.zip,"ZIP Bundle for HTTPNetworkSniffer.exe" +iconsext.exe,"Extract icons and cursors from executbale files (EXE, DLL, OCX, CPL, etc.)" +iconsext.zip,"ZIP Bundle for iconsext.exe" +IECacheView.exe,"List all files currently stored in the cache of Internet Explorer." +iecacheview.zip,"ZIP Bundle for IECacheView.exe" +iecv.exe,"Displays the cookies that Internet Explorer stores on your computer" +iecv.zip,"ZIP Bundle for iecv.exe" +IEDesignMode.exe,"Switch the active Internet Explorer window to design mode. " +iedesignmode.zip,"ZIP Bundle for IEDesignMode.exe" +iehv.exe,"Displays the list of Web sites that you visited with IE Web browser." +iehv.zip,"ZIP Bundle for iehv.exe" +iepv.exe,"Recover passwords stored by Internet Explorer (Versions 4.0 - 8.0)" +iepv.zip,"ZIP Bundle for iepv.exe" +ImageCacheViewer.exe,"Displays images stored in the cache of your Web browsers." +imagecacheviewer.zip,"ZIP Bundle for ImageCacheViewer.exe" +InjectedDLL.exe,"Display the list of injected DLLs." +injecteddll.zip,"ZIP Bundle for InjectedDLL.exe" +InsideClipboard.exe,"Displays the content of all formats stored in the clipboard." +insideclipboard.zip,"ZIP Bundle for InsideClipboard.exe" +InstalledAppView.exe,"View installed Windows 10 apps" +installedappview.zip,"ZIP Bundle for InstalledAppView.exe" +InstalledCodec.exe,"List Codec drivers and DirectShow filters installed on your system." +installedcodec.zip,"ZIP Bundle for InstalledCodec.exe" +InstalledDriversList.exe,"Lists all device drivers that are currently installed on your system." +installeddriverslist.zip,"ZIP Bundle for InstalledDriversList.exe" +InstalledPackagesView.exe,"Displays installed MSI packages on your system." +installedpackagesview.zip,"ZIP Bundle for InstalledPackagesView.exe" +IPInfoOffline.exe,"view country information about IP addresses." +ipinfooffline.zip,"ZIP Bundle for IPInfoOffline.exe" +IPNeighborsView.exe,"View the IP neighbor table on Windows 10/8/7/Vista" +ipneighborsview.zip,"ZIP Bundle for IPNeighborsView.exe" +IPNetInfo.exe,"NirSoft IPNetInfo utility." +ipnetinfo.zip,"ZIP Bundle for ipnetinfo.exe" +IPPathTableView.exe,"IP Path Table Viewer" +ippathtableview.zip,"ZIP Bundle for IPPathTableView.exe" +jrview.exe,"Displays the installed Java Runtime Environments." +jrview.zip,"ZIP Bundle for jrview.exe" +jsae.exe,"Creates Javascript animation from image files on your local drive." +jsae.zip,"ZIP Bundle for jsae.exe" +JumpListsView.exe,"Displays the information stored by the Jump Lists feature of Windows 7." +jumplistsview.zip,"ZIP Bundle for JumpListsView.exe" +KeyboardStateView.exe,"Shows the current state and virtual key code of every key you press." +keyboardstateview.zip,"ZIP Bundle for KeyboardStateView.exe" +LANIPScanner.exe,"Local network scanner for Windows" +lanipscanner.zip,"ZIP Bundle for LANIPScanner.exe" +LastActivityView.exe,"View the latest computer activity." +lastactivityview.zip,"ZIP Bundle for LastActivityView.exe" +LiveContactsView.exe,"View the details of all contacts in your Windows Live Messenger." +livecontactsview.zip,"ZIP Bundle for LiveContactsView.exe" +LiveTcpUdpWatch.exe,"Displays live information about all TCP and UDP activity on your system." +livetcpudpwatch.zip,"ZIP Bundle for LiveTcpUdpWatch.exe" +LoadedDllsView.exe,"Displays all DLL files loaded on your system." +loadeddllsview.zip,"ZIP Bundle for LoadedDllsView.exe" +LostMyPassword.exe,"Password recovery tool for Windows" +lostmypassword.zip,"ZIP Bundle for LostMyPassword.exe" +LSASecretsDump.exe,"Dump the LSA secrets from the Registry." +lsasecretsdump.zip,"ZIP Bundle for LSASecretsDump.exe" +LSASecretsView.exe,"Displays the list of all LSA secrets stored in the Registry on your computer. " +lsasecretsview.zip,"ZIP Bundle for LSASecretsView.exe" +MACAddressView.exe,"MAC address lookup tool" +macaddressview.zip,"ZIP Bundle for MACAddressView.exe" +MadPassExt.exe,"Extract the secret DPAPI password generated for your Microsoft account" +madpassext.zip,"ZIP Bundle for MadPassExt.exe" +mailpv.exe,"Recovers email passwords" +mailpv.zip,"ZIP Bundle for mailpv.exe" +ManageWirelessNetworks.exe,"Alternative tool to the standard Manage Wireless Networks of Windows " +managewirelessnetworks.zip,"ZIP Bundle for ManageWirelessNetworks.exe" +mDNSView.exe,"Displays all mDNS records published by devcies connected to your local network." +mdnsview.zip,"ZIP Bundle for mDNSView.exe" +MMCSnapInsView.exe,"Displays the details of all MMC snap-ins installed on your system." +mmcsnapinsview.zip,"ZIP Bundle for MMCSnapInsView.exe" +mmview.exe,"Lists the installed Codec, and allows you to disable/enable them." +mmview.zip,"ZIP Bundle for mmview.exe" +MobileFileSearch.exe,"Search files inside a mobile device plugged to the USB port on your computer" +mobilefilesearch.zip,"ZIP Bundle for MobileFileSearch.exe" +MonitorInfoView.exe,"displays essential information about your monitor." +monitorinfoview.zip,"ZIP Bundle for MonitorInfoView.exe" +MozillaCacheView.exe,"Displays the list of files stored in the cache of Mozilla-based Web browsers." +mozillacacheview.zip,"ZIP Bundle for MozillaCacheView.exe" +MozillaHistoryView.exe,"Displays the list of visited Web sites in Firefox/Mozilla/Netscape Web browsers." +MozillaHistoryView.exe,"Package of Web browser tools for Windows" +mozillahistoryview.zip,"ZIP Bundle for MozillaHistoryView.exe" +mspass.exe,"Password Recovery package for Windows." +mspass.exe,"Recovers the passwords of instant messenger programs" +mspass.zip,"ZIP Bundle for mspass.exe" +MUICacheView.exe,"Edit/delete MUICache items in your system" +muicacheview.zip,"ZIP Bundle for MUICacheView.exe" +MultiMonitorTool.exe,"Enable, disable, and set the primary monitor in Multi-Monitor system." +multimonitortool.zip,"ZIP Bundle for MultiMonitorTool.exe" +mweather.exe,"Decode METAR weather reports, and display them in a simple weather report table." +mweather.zip,"ZIP Bundle for mweather.exe" +MyEventViewer.exe,"MyEventViewer is a simple alternative to the standard event viewer of Windows." +myeventviewer.zip,"ZIP Bundle for MyEventViewer.exe" +MyLastSearch.exe,"View your latest searches with Google, Yahoo, and MSN" +mylastsearch.zip,"ZIP Bundle for MyLastSearch.exe" +myuninst.exe,"Alternative utility to the standard Add/Remove applet of Windows." +myuninst.zip,"ZIP Bundle for myuninst.exe" +MZCacheView.exe,"List all files currently stored in the cache of Firefox/Mozilla browser." +mzcacheview.zip,"ZIP Bundle for MZCacheView.exe" +mzcv.exe,"alternative to the standard Cookie Manager provided by Firefox and Mozilla." +mzcv.zip,"ZIP Bundle for mzcv.exe" +NetBScanner.exe,"Scans all computers in the IP addresses range you choose, using NetBIOS protocol" +netbscanner.zip,"ZIP Bundle for NetBScanner.exe" +NetConnectChoose.exe,"Set default Internet connection and view general connection information." +netconnectchoose.zip,"ZIP Bundle for NetConnectChoose.exe" +netpass.exe,"Recover network passwords on Windows XP/2003/Vista." +netpass.zip,"ZIP Bundle for netpass.exe" +NetResView.exe,"displays the list of all network resources on your LAN." +netresview.zip,"ZIP Bundle for NetResView.exe" +NetRouteView.exe,"GUI alternative to the standard route utility of Windows." +netrouteview.zip,"ZIP Bundle for NetRouteView.exe" +NetworkConnectLog.exe,"Shows a log of connected/disconnected computers on your network." +networkconnectlog.zip,"ZIP Bundle for NetworkConnectLog.exe" +NetworkCountersWatch.exe,"Displays system counters for every network interface on your system." +networkcounterswatch.zip,"ZIP Bundle for NetworkCountersWatch.exe" +NetworkInterfacesView.exe,"Displays the list of all network adapters/interfaces installed on your system." +networkinterfacesview.zip,"ZIP Bundle for NetworkInterfacesView.exe" +NetworkLatencyView.exe,"Calculates the network latency (in milliseconds) for every new TCP connection." +networklatencyview.zip,"ZIP Bundle for NetworkLatencyView.exe" +NetworkOpenedFiles.exe,"Displays the files that are currently opened by other computers on your network." +networkopenedfiles.zip,"ZIP Bundle for NetworkOpenedFiles.exe" +networktools.zip,"ZIP Bundle for cports.exe" +NetworkTrafficView.exe,"Displays network traffic statistics on your network adapter" +networktrafficview.zip,"ZIP Bundle for NetworkTrafficView.exe" +NetworkUsageView.exe,"Displays network usage information for Windows 8 and Windows 10" +networkusageview.zip,"ZIP Bundle for NetworkUsageView.exe" +nircmd.exe,"Do many useful tasks from command-line." +nircmd.zip,"ZIP Bundle for nircmd.exe" +nirext.exe,"Adds 3 useful context menu extensions to your Windows Explorer environment." +nirext.zip,"ZIP Bundle for nirext.exe" +NK2Edit.exe,"Full NK2 (AutoComplete) editor for Microsoft Outlook" +nk2edit.zip,"ZIP Bundle for NK2Edit.exe" +nk2view.exe,"View the content of Outlook AutoComplete .NK2 file." +nk2view.zip,"ZIP Bundle for nk2view.exe" +NTFSLinksView.exe,"View the list of NTFS symbolic links/junctions in selected folder." +ntfslinksview.zip,"ZIP Bundle for NTFSLinksView.exe" +OfficeIns.exe,"displays the details of all installed Microsoft Office add-ins on your computer." +officeins.zip,"ZIP Bundle for OfficeIns.exe" +OfflineRegistryFinder.exe,"Find data in external Registry files" +offlineregistryfinder.zip,"ZIP Bundle for OfflineRegistryFinder.exe" +OfflineRegistryView.exe,"View offline Registry files" +offlineregistryview.zip,"ZIP Bundle for OfflineRegistryView.exe" +ofview.zip,"ZIP Bundle for OpenedFilesView.exe" +OpenedFilesView.exe,"Displays the list of all opened files on your system." +OpenSaveFilesView.exe,"Displays list of files that you previously opened." +opensavefilesview.zip,"ZIP Bundle for OpenSaveFilesView.exe" +OpenWithView.exe,"Disable/enable items in the Open With dialog-box of Windows." +openwithview.zip,"ZIP Bundle for OpenWithView.exe" +OperaCacheView.exe,"Cache viewer for Opera Web browser." +operacacheview.zip,"ZIP Bundle for OperaCacheView.exe" +OperaPassView.exe,"Password recovery tool for Opera Web browser." +operapassview.zip,"ZIP Bundle for OperaPassView.exe" +OutlookAccountsView.exe,"View POP3/IMAP/SMTP passwords and account settings of Outlook" +outlookaccountsview.zip,"ZIP Bundle for OutlookAccountsView.exe" +OutlookAddressBookView.exe,"Displays the details of all recipients stored in the address books of Outlook" +outlookaddressbookview.zip,"ZIP Bundle for OutlookAddressBookView.exe" +OutlookAttachView.exe,"Extract multiple attachments from Outlook." +outlookattachview.zip,"ZIP Bundle for OutlookAttachView.exe" +OutlookStatView.exe,"Display a general statistics of your Outlook emails." +outlookstatview.zip,"ZIP Bundle for OutlookStatView.exe" +outlooktools.zip,"ZIP Bundle for nk2edit.exe" +passreccommandline.zip,"ZIP Bundle for PassRecCommandLine.exe" +passrecenc.zip,"ZIP Bundle for PassRecEnc.exe" +passrecpk.zip,"ZIP Bundle for mspass.exe" +passrecview.zip,"ZIP Bundle for PassRecView.exe" +PasswordFox.exe,"View passwords stored in Firefox Web browser." +passwordfox.zip,"ZIP Bundle for PasswordFox.exe" +PasswordHashesView.exe,"Displays the SHA1 and NTLM hashes of login passwords for currently logged-in users." +passwordhashesview.zip,"ZIP Bundle for PasswordHashesView.exe" +PasswordScan.exe,"Displays security information about passwords stored in your system." +passwordscan.zip,"ZIP Bundle for PasswordScan.exe" +PingInfoView.exe,"ping multiple host names and IP addresses." +pinginfoview.zip,"ZIP Bundle for PingInfoView.exe" +PocketAsterisk.exe,"Reveals the passwords stored behind the asterisks (***)" +pocketasterisk.zip,"ZIP Bundle for PocketAsterisk.exe" +PreviousFilesRecovery.exe,"find and recovery files from Windows shadow copies" +previousfilesrecovery.zip,"ZIP Bundle for PreviousFilesRecovery.exe" +ProcessActivityView.exe,"Show the file activity for selected process." +processactivityview.zip,"ZIP Bundle for ProcessActivityView.exe" +ProcessTCPSummary.exe,"Displays TCP connections summary" +processtcpsummary.zip,"ZIP Bundle for ProcessTCPSummary.exe" +ProcessThreadsView.exe,"Displays extensive information about all threads of the process that you choose." +processthreadsview.zip,"ZIP Bundle for ProcessThreadsView.exe" +ProductKeyScanner.exe,"Find product keys stored in the Registry of Windows Operating system" +productkeyscanner.zip,"ZIP Bundle for ProductKeyScanner.exe" +ProduKey.exe,"Displays the CD-Keys of MS-Office/Windows installed on your computer." +ProduKey.exe,"Package of system tools for Windows" +produkey.zip,"ZIP Bundle for ProduKey.exe" +progtools.zip,"ZIP Bundle for dllexp.exe" +PropertySystemView.exe,"View/edit file properties" +propertysystemview.zip,"ZIP Bundle for PropertySystemView.exe" +pspv.exe,"reveals the passwords stored on your computer by Internet Explorer." +pspv.zip,"ZIP Bundle for pspv.exe" +PstPassword.exe,"Recover lost password of Outlook PST file." +pstpassword.zip,"ZIP Bundle for PstPassword.exe" +QuickSetDNS.exe,"Change the DNS servers that are used for your Internet connection." +quicksetdns.zip,"ZIP Bundle for QuickSetDNS.exe" +rdpv.exe,"Reveals the password stored by Microsoft Remote Desktop utility." +rdpv.zip,"ZIP Bundle for rdpv.exe" +RecentFilesView.exe,"Display the list of recently opened files" +recentfilesview.zip,"ZIP Bundle for RecentFilesView.exe" +RegDllView.exe,"RegDllView is a small utility that displays the list of all registered files." +regdllview.zip,"ZIP Bundle for RegDllView.exe" +RegFileExport.exe,"Export offline Registry file to .reg file" +regfileexport.zip,"ZIP Bundle for RegFileExport.exe" +RegFromApp.exe,"Creates .reg file according to Registry changes made by application." +regfromapp.zip,"ZIP Bundle for RegFromApp.exe" +RegHiveBackup.exe,"Backs up Registry files and user Registry hives to a specified folder." +reghivebackup.zip,"ZIP Bundle for RegHiveBackup.exe" +RegistryChangesView.exe,"Compares 2 snapshots of Windows Registry." +registrychangesview.zip,"ZIP Bundle for RegistryChangesView.exe" +RegScanner.exe,"Package of 5 Windows Registry tools for advanced users" +RegScanner.exe,"Scan and find values in the Registry" +regscanner.zip,"ZIP Bundle for RegScanner.exe" +regtools.zip,"ZIP Bundle for RegScanner.exe" +ResourcesExtract.exe,"Extract embedded resources from .NET applications." +ResourcesExtract.exe,"Extract resources from dll/ocx/exe files." +resourcesextract.zip,"ZIP Bundle for ResourcesExtract.exe" +RouterPassView.exe,"Recover passwords from router config file." +routerpassview.zip,"ZIP Bundle for RouterPassView.exe" +RTMPDumpHelper.exe,"Download RTMP streams in conjunction with RTMPDump toolkit." +rtmpdumphelper.zip,"ZIP Bundle for RTMPDumpHelper.exe" +RunAsDate.exe,"Run a program with the specified date." +runasdate.zip,"ZIP Bundle for RunAsDate.exe" +RunFromProcess.exe,"Run a program from another process that you choose." +runfromprocess.zip,"ZIP Bundle for RunFromProcess.exe" +RuntimeClassesView.exe,"Displays the list of Windows Runtime (WinRT) classes" +runtimeclassesview.zip,"ZIP Bundle for RuntimeClassesView.exe" +SafariCacheView.exe,"Cache viewer/extractor for Safari Web browser" +safaricacheview.zip,"ZIP Bundle for SafariCacheView.exe" +SafariHistoryView.exe,"History viewer for Safari Web browser" +safarihistoryview.zip,"ZIP Bundle for SafariHistoryView.exe" +SearchFilterView.exe,"view the search filters installed on your system." +searchfilterview.zip,"ZIP Bundle for SearchFilterView.exe" +SearchMyFiles.exe,"Alternative to the standard Search For Files And Folders module of Windows." +searchmyfiles.zip,"ZIP Bundle for SearchMyFiles.exe" +SecurityQuestionsView.exe,"View Windows 10 security questions" +securityquestionsview.zip,"ZIP Bundle for SecurityQuestionsView.exe" +SecuritySoftView.exe,"Displays the list of AntiVirus/AntiSpyware/ Firewall programs on your system." +securitysoftview.zip,"ZIP Bundle for SecuritySoftView.exe" +SeqDownload.exe,"Download sequence of images from the Web, and create animation from them." +seqdownload.zip,"ZIP Bundle for SeqDownload.exe" +serviwin.exe,"displays the list of installed drivers and services on your system." +serviwin.zip,"ZIP Bundle for serviwin.exe" +ShadowCopyView.exe,"View shadow copies on your system" +shadowcopyview.zip,"ZIP Bundle for ShadowCopyView.exe" +ShellBagsView.exe,"Displays the list of all folder settings saved by Windows. " +shellbagsview.zip,"ZIP Bundle for ShellBagsView.exe" +ShellMenuNew.exe,"Disable/Enable items in the New submenu of Explorer." +shellmenunew.zip,"ZIP Bundle for ShellMenuNew.exe" +shexview.exe,"Displays the details of shell extensions installed on your computer." +shexview.zip,"ZIP Bundle for shexview.exe" +shman.exe,"Lists all shortcuts on your desktop/start menu." +shman.zip,"ZIP Bundle for shman.exe" +shmnview.exe,"Disable/enable static menu items in context menu of Explorer." +shmnview.zip,"ZIP Bundle for shmnview.exe" +ShutdownPerformanceView.exe,"Displays the performance information of Windows shutdown process" +shutdownperformanceview.zip,"ZIP Bundle for ShutdownPerformanceView.exe" +SimpleCodeGenerator.exe,"QR Code Generator for Windows" +simplecodegenerator.zip,"ZIP Bundle for SimpleCodeGenerator.exe" +SimpleProgramDebugger.exe,"Displays debugging events of a running program." +simpleprogramdebugger.zip,"ZIP Bundle for SimpleProgramDebugger.exe" +SimpleWMIView.exe,"Displays the result of WMI queries in a simple table" +simplewmiview.zip,"ZIP Bundle for SimpleWMIView.exe" +SiteShoter.exe,"Save a screenshot of any Web page into a file." +siteshoter.zip,"ZIP Bundle for SiteShoter.exe" +SkypeContactsView.exe,"Displays the list of Skype contacts stored in the local database file of Skype." +skypecontactsview.zip,"ZIP Bundle for SkypeContactsView.exe" +SkypeLogView.exe,"View log files created by Skype" +skypelogview.zip,"ZIP Bundle for SkypeLogView.exe" +smsniff.exe,"Captures TCP/IP packets and view the captured data as sequence of conversations." +smsniff.zip,"ZIP Bundle for smsniff.exe" +SniffPass.exe,"capture the passwords that pass through your network adapter." +sniffpass.zip,"ZIP Bundle for SniffPass.exe" +SocketSniff.exe,"Watch the Windows Sockets (WinSock) activity of the selected process." +socketsniff.zip,"ZIP Bundle for SocketSniff.exe" +SoundVolumeView.exe,"A package of 6 tools for Windows related to video/audio." +SoundVolumeView.exe,"View/change sound levels & save/load sound level profiles on Windows Vista/7/8" +soundvolumeview.zip,"ZIP Bundle for SoundVolumeView.exe" +SpecialFoldersView.exe,"Easily jump to special folders in your system." +specialfoldersview.zip,"ZIP Bundle for SpecialFoldersView.exe" +strun.exe,"Displays the list of all applications that are loaded on startup." +strun.zip,"ZIP Bundle for strun.exe" +svcl.exe,"Sound volume command-line tool for Windows" +svcl.zip,"ZIP Bundle for svcl.exe" +sysexp.exe,"Grab the data stored in list-views, tree-views, list boxes, and combo boxes." +sysexp.zip,"ZIP Bundle for sysexp.exe" +systools.zip,"ZIP Bundle for ProduKey.exe" +TableTextCompare.exe,"Compare tab-delimited or comma-delimited (csv) files." +tabletextcompare.zip,"ZIP Bundle for TableTextCompare.exe" +TaskSchedulerView.exe,"View/Disable/Enable tasks from the Task Scheduler of Windows." +taskschedulerview.zip,"ZIP Bundle for TaskSchedulerView.exe" +TCPConnectProblemView.exe,"Monitor TCP connection problems." +tcpconnectproblemview.zip,"ZIP Bundle for TCPConnectProblemView.exe" +TcpLogView.exe,"Monitors the opened TCP connections on your system." +tcplogview.zip,"ZIP Bundle for TcpLogView.exe" +TimeZonesView.exe,"Displays all world time zones." +timezonesview.zip,"ZIP Bundle for TimeZonesView.exe" +TurnedOnTimesView.exe,"View the time/date ranges that your computer was turned on." +turnedontimesview.zip,"ZIP Bundle for TurnedOnTimesView.exe" +UninstallView.exe,"Shows installed programs on your system and allows you to uninstall them." +uninstallview.zip,"ZIP Bundle for UninstallView.exe" +URLProtocolView.exe,"View/disable/enable the URL protocols installed on your system" +urlprotocolview.zip,"ZIP Bundle for URLProtocolView.exe" +URLStringGrabber.exe,"Grab URL strings of Web sites from Internet Explorer" +urlstringgrabber.zip,"ZIP Bundle for URLStringGrabber.exe" +USBDeview.exe,"Lists all installed USB devices that you previously used." +usbdeview.zip,"ZIP Bundle for USBDeview.exe" +USBDriveLog.exe,"USB Drive Log For Windows 10" +usbdrivelog.zip,"ZIP Bundle for USBDriveLog.exe" +USBLogView.exe,"Records the details of any USB device that is plugged/unplugged into your system" +usblogview.zip,"ZIP Bundle for USBLogView.exe" +UserAssistView.exe,"This utility decrypt and displays the list of all UserAssist entries" +userassistview.zip,"ZIP Bundle for UserAssistView.exe" +UserProfilesView.exe,"View user profiles information on your system." +userprofilesview.zip,"ZIP Bundle for UserProfilesView.exe" +VaultPasswordView.exe,"Decrypts passwords stored in Windows Vault" +vaultpasswordview.zip,"ZIP Bundle for VaultPasswordView.exe" +videoaudiotools.zip,"ZIP Bundle for SoundVolumeView.exe" +VideoCacheView.exe,"Extract Web site video files from the cache of your Web browser" +videocacheview.zip,"ZIP Bundle for VideoCacheView.exe" +VNCPassView.exe,"Recover the passwords stored by the VNC tool." +vncpassview.zip,"ZIP Bundle for VNCPassView.exe" +volumouse.exe,"Adjust the volume of your speaker with the wheel of your mouse." +volumouse.zip,"ZIP Bundle for volumouse.exe" +WakeMeOnLan.exe,"Turn on one or more computers remotely by sending Wake-on-LAN (WOL) packet" +wakemeonlan.zip,"ZIP Bundle for WakeMeOnLan.exe" +WebBrowserBookmarksView.exe,"View all bookmarks of Chrome and Firefox Web browsers." +webbrowserbookmarksview.zip,"ZIP Bundle for WebBrowserBookmarksView.exe" +WebBrowserPassView.exe,"Recover lost passwords from your Web browser." +webbrowserpassview.zip,"ZIP Bundle for WebBrowserPassView.exe" +WebCacheImageInfo.exe,"Shows EXIF information of the images stored in Web browser cache." +webcacheimageinfo.zip,"ZIP Bundle for WebCacheImageInfo.exe" +WebCamImageSave.exe,"Capture still images from your WebCam." +webcamimagesave.zip,"ZIP Bundle for WebCamImageSave.exe" +WebCookiesSniffer.exe,"Captures Web site cookies and displays them in a simple table" +webcookiessniffer.zip,"ZIP Bundle for WebCookiesSniffer.exe" +WebSiteSniffer.exe,"Capture Web site files and save them on your hard drive." +websitesniffer.zip,"ZIP Bundle for WebSiteSniffer.exe" +WebVideoCap.exe,"Capture Flash Video files and RTSP streams while watching them in a Web browser." +webvideocap.zip,"ZIP Bundle for WebVideoCap.exe" +WhatInStartup.exe,"disable/enable/delete programs that are loaded at Windows startup." +whatinstartup.zip,"ZIP Bundle for WhatInStartup.exe" +WhatIsHang.exe,"Get information about Windows software that hangs." +whatishang.zip,"ZIP Bundle for WhatIsHang.exe" +WhoisCL.exe,"Get WHOIS information about a registered domain from command-line." +whoiscl.zip,"ZIP Bundle for WhoisCL.exe" +WhoIsConnectedSniffer.exe,"Shows who connects to your network by listening to network packets." +whoisconnectedsniffer.zip,"ZIP Bundle for WhoIsConnectedSniffer.exe" +whoistd.exe,"NirSoft WhoisTD utility." +whoistd.zip,"ZIP Bundle for whoistd.exe" +whosip.exe,"find all available information about an IP address from command-line." +whosip.zip,"ZIP Bundle for whosip.exe" +WifiChannelMonitor.exe,"Captures wifi traffic in monitor mode and displays AP/clients information." +wifichannelmonitor.zip,"ZIP Bundle for WifiChannelMonitor.exe" +WifiDiagnosticsView.exe,"Wifi diagnostics tool for Windows" +wifidiagnosticsview.zip,"ZIP Bundle for WifiDiagnosticsView.exe" +WifiHistoryView.exe,"Displays the history of connections to wireless networks on your computer. " +wifihistoryview.zip,"ZIP Bundle for WifiHistoryView.exe" +WifiInfoView.exe,"Displays extensive information about wireless networks in your area." +wifiinfoview.zip,"ZIP Bundle for WifiInfoView.exe" +WinCrashReport.exe,"Displays a report about crashed Windows application." +wincrashreport.zip,"ZIP Bundle for WinCrashReport.exe" +WinDefLogView.exe,"Windows Defender Log Viewer" +windeflogview.zip,"ZIP Bundle for WinDefLogView.exe" +WinDefThreatsView.exe,"View Windows Defender threats of local and remote computer" +windefthreatsview.zip,"ZIP Bundle for WinDefThreatsView.exe" +WinFontsView.exe,"Display sample of all fonts installed on your system." +winfontsview.zip,"ZIP Bundle for WinFontsView.exe" +winlister.exe,"This utility displays the list of opened windows on your system. " +winlister.zip,"ZIP Bundle for winlister.exe" +WinLogOnView.exe,"Displays logon/logoff times on Windows Vista/7/8/2008" +winlogonview.zip,"ZIP Bundle for WinLogOnView.exe" +WinMailPassRec.exe,"Password Recovery For Windows Mail App of Windows 10 and Windows 11" +winmailpassrec.zip,"ZIP Bundle for WinMailPassRec.exe" +WinPrefetchView.exe,"View the Prefetch files (.pf) stored in your system." +winprefetchview.zip,"ZIP Bundle for WinPrefetchView.exe" +WinsockServicesView.exe,"View/Disable/Enable Winsock service providers installed on your system." +winsockservicesview.zip,"ZIP Bundle for WinsockServicesView.exe" +WinUpdatesView.exe,"Displays the history of Windows updates for your system." +winupdatesview.zip,"ZIP Bundle for WinUpdatesView.exe" +WirelessConnectionInfo.exe,"Displays general information and statistics about the active wifi connection." +wirelessconnectioninfo.zip,"ZIP Bundle for WirelessConnectionInfo.exe" +WirelessKeyDump.exe,"dumps the list of all wireless keys stored by Windows" +wirelesskeydump.zip,"ZIP Bundle for WirelessKeyDump.exe" +WirelessKeyView.exe,"recovers lost wireless network keys (WEP/WPA) stored in your computer." +wirelesskeyview.zip,"ZIP Bundle for WirelessKeyView.exe" +WirelessNetConsole.exe,"View wireless networks information (console application)" +wirelessnetconsole.zip,"ZIP Bundle for WirelessNetConsole.exe" +WirelessNetView.exe,"Monitor the activity of wireless networks around you." +wirelessnetview.zip,"ZIP Bundle for WirelessNetView.exe" +WNetWatcher.exe,"Shows who is connected to your wireless network." +wnetwatcher.zip,"ZIP Bundle for WNetWatcher.exe" +wul.exe,"Displays the list of all Windows updates (Service Packs and Hotfixes)." +wul.zip,"ZIP Bundle for wul.exe" +zipinst.exe,"Install applications that do not provide an installation module." +zipinst.zip,"ZIP Bundle for zipinst.exe" diff --git a/lookups/csv/nirsoft_utilities_lookup.yml b/lookups/csv/nirsoft_utilities_lookup.yml new file mode 100644 index 0000000000..ebd1525ea4 --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.yml @@ -0,0 +1,12 @@ +name: nirsoft_utilities_lookup +id: 9ebf4dba-02a9-4f64-9f06-f02d4023c52a +version: 1 +creation_date: '2026-10-01' +modification_date: '2026-10-01' +author: Splunk Threat Research Team +lookup_type: csv +description: A subset of utilities provided by NirSoft that may be used by adversaries. +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +case_sensitive_match: false From adc69d950e1fe19393d418269ed7881c95a98104 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 13 Oct 2026 18:19:57 -0700 Subject: [PATCH 161/164] Fix Failing Integration Tests (#4338) --------- Co-authored-by: Nasreddine Bencherchali --- data_sources/sysmon_eventid_15.yml | 72 ++++++++++--------- data_sources/sysmon_eventid_22.yml | 65 ++++++++--------- ..._aws_ecr_container_upload_unknown_user.yml | 50 +++++++++---- ...iles_filter_loaded_by_uncommon_process.yml | 40 ++++++----- ...tem_process_querying_definition_update.yml | 34 ++++++--- ...rmgr_alternate_data_stream_in_temp_dir.yml | 11 +-- 6 files changed, 157 insertions(+), 115 deletions(-) diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 45aa929ea7..26bc8419fa 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 15 id: 95785e02-93b4-47e2-81f1-be326295348e -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-13' author: Patrick Bareiss, Splunk description: Logs the creation of a new file stream, including details about the file stream's hash, path, and associated process metadata. mitre_components: @@ -22,43 +22,11 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - Contents - CreationUtcTime - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Hash - - IMPHASH - - Image - - Keywords - - Level - - MD5 - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SHA256 - - SecurityID - - SystemTime - - System_Props_Xml - - TargetFilename - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -70,33 +38,66 @@ fields: - dest - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - file_create_time - file_hash - file_name - file_path + - Guid + - Hash - host - id + - Image + - IMPHASH - index + - Keywords + - Level - linecount + - MD5 + - Name + - Opcode - os - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessId + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - SHA256 - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - TargetFilename + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc @@ -110,6 +111,7 @@ output_fields: - process_path - signature - signature_id + - user - user_id - vendor_product example_log: 15241500x8000000000000000667860Microsoft-Windows-Sysmon/Operationalproject-mumbai-host-2021-04-28 20:11:34.709{ED2ECF8A-C154-6089-F967-00000000BB01}7000C:\Users\DefaultAccount\AppData\Roaming\Telegram Desktop\Telegram.exeC:\Users\DefaultAccount\Downloads\Telegram Desktop\Good(NLA).txt:Zone.Identifier2021-04-28 20:11:33.238MD5=C785C55D5FA3443A11B8417209C4B524,SHA256=D07777E0DC36EBECCE3FA9644F0F44DC4A0B7EDE0CBC1F5D33E8D6CB07AF5B5C,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index fdaa49c146..2a53a74962 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 22 id: 911538b2-eba7-4d3e-85e8-d82d380c37bf -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-13' author: Patrick Bareiss, Splunk description: Logs DNS query events, including details about the queried domain, source IP, query type, and response data. mitre_components: @@ -24,36 +24,6 @@ fields: - _time - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - QueryName - - QueryResults - - QueryStatus - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - date_hour - date_mday - date_minute @@ -64,30 +34,61 @@ fields: - date_zone - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name + - Opcode - process_exec - process_guid - process_name + - ProcessGuid + - ProcessId + - ProcessID - punct - query - query_count + - QueryName + - QueryResults + - QueryStatus + - record_type + - RecordID + - RecordNumber - reply_code_id + - RuleName + - SecurityID - signature - signature_id - source - sourcetype - splunk_server - src + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - answer - answer_count diff --git a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml index 404144c034..6831869df1 100644 --- a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml @@ -1,27 +1,47 @@ name: ASL AWS ECR Container Upload Unknown User id: 886a8f46-d7e2-4439-b9ba-aec238e31732 -version: 12 +version: 13 creation_date: '2024-05-22' modification_date: '2026-05-13' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized. This detection is crucial for a SOC as it can indicate a potential compromise or misuse of AWS ECR, which could lead to unauthorized access to sensitive data or the deployment of malicious containers. By identifying and investigating these events, organizations can mitigate the risk of data breaches or other security incidents resulting from unauthorized container uploads. The impact of such an attack could be significant, compromising the integrity and security of the organization's cloud environment. +description: |- + The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. + It identifies instances where a new container is uploaded by a user not previously recognized as authorized. data_source: - ASL AWS CloudTrail search: |- - `amazon_security_lake` api.operation=PutImage NOT `aws_ecr_users_asl` - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY actor.user.uid api.operation api.service.name - http_request.user_agent src_endpoint.ip actor.user.account.uid - cloud.provider cloud.region - | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `asl_aws_ecr_container_upload_unknown_user_filter` -how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. -known_false_positives: No false positives have been identified at this time. + `amazon_security_lake` + api.operation=PutImage + NOT `aws_ecr_users_asl` + + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by actor.user.uid api.operation api.service.name + http_request.user_agent + src_endpoint.ip actor.user.account.uid + cloud.provider cloud.region + + | rename actor.user.account.uid as vendor_account + actor.user.uid as user + api.operation as action + api.service.name as dest + cloud.provider as vendor_product + cloud.region as vendor_region + http_request.user_agent as user_agent + src_endpoint.ip as src + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `asl_aws_ecr_container_upload_unknown_user_filter` +how_to_implement: |- + The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1204/003/ drilldown_searches: @@ -38,7 +58,7 @@ intermediate_findings: - field: user type: user score: 20 - message: Container uploaded from unknown user $user$ + message: Container uploaded from unknown user [$user$]. threat_objects: - field: src type: ip_address diff --git a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml index f15a399546..8e6bd9a38d 100644 --- a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml +++ b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml @@ -1,13 +1,13 @@ name: Windows Cloud Files Filter Loaded by Uncommon Process id: 77b85062-274e-43a5-9dab-c25862b85291 -version: 1 +version: 2 creation_date: '2026-05-18' -modification_date: '2026-05-18' +modification_date: '2026-10-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - The following analytic detects cldapi.dll being loaded by a process not associated with legitimate cloud sync activity. + The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity. The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits. data_source: - Sysmon EventID 7 @@ -16,22 +16,25 @@ search: |- EventID=7 ImageLoaded="*\\cldapi.dll" NOT Image IN ( - "*\\box.exe", - "*\\dropbox.exe", - "*\\googledrivefs.exe", - "*\\icloud.exe", - "*\\onedrive*.exe", - "*\\Windows\\explorer.exe" - "*\\Windows\\System32\\*", - "*\\Windows\\Syswow64\\*", - "*\\Windows\\WinSxS\\*" + "*\\box.exe", + "*\\dropbox.exe", + "*\\googledrivefs.exe", + "*\\icloud.exe", + "*\\onedrive*.exe", + "C:\\Windows\\explorer.exe", + "C:\\Windows\\System32\\*", + "C:\\Windows\\Syswow64\\*", + "C:\\Windows\\WinSxS\\*" ) + | stats count min(_time) as firstTime max(_time) as lastTime - by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec - process_guid process_hash process_id process_name process_path - service_dll_signature_exists service_dll_signature_verified signature_id user_id - vendor_product + + by dest loaded_file_path loaded_file + process_path process_name process_exec process_guid process_hash process_id + service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cloud_files_filter_loaded_by_uncommon_process_filter` @@ -57,7 +60,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: Cloud Files Filter ($ImageLoaded$) loaded by suspicious process $Image$ on $dest$ + message: Cloud Files Filter [$loaded_file_path$] loaded by suspicious process [$process_path$] on [$dest$] +threat_objects: + - field: loaded_file_path + type: loaded_file analytic_story: - RedSun - BlueHammer diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml index f2a81e0116..b428d437a8 100644 --- a/detections/endpoint/windows_non_system_process_querying_definition_update.yml +++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml @@ -1,13 +1,14 @@ name: Windows Non-System Process Querying Definition Update id: 9d375cfd-c9a5-48ff-b875-9bcaf6b63265 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-10-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain. + Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. + BlueHammer utilizes these definition updates as part of its exploit chain. data_source: - Sysmon EventID 22 search: |- @@ -15,16 +16,27 @@ search: |- EventID="22" QueryName="*definitionupdates.microsoft.com*" NOT Image IN ( - "*:\\Program Files\\Microsoft Office\\*", - "*:\\Program Files\\Windows Defender\\*", - "*:\\ProgramData\\Microsoft\\Windows Defender\\*", - "*:\\Windows\\System32\\*", - "*:\\Windows\\SysWOW64\\*" + "C:\\Program Files\\Microsoft Office\\*", + "C:\\Program Files\\Windows Defender\\*", + "C:\\ProgramData\\Microsoft\\Windows Defender\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SysWOW64\\*" ) - | stats count min(_time) as firstTime max(_time) as lastTime BY answer answer_count dvc Computer process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus + + | rename Computer as dest, + Image as process_path + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by src dest answer answer_count + process_path process_name process_exec process_guid + query query_count QueryResults record_type reply_code_id + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename Computer as dest + | `windows_non_system_process_querying_definition_update_filter` how_to_implement: |- The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. @@ -46,7 +58,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Non-System process $Image$ queried Windows Defender Definition Updates domain $QueryName$ on $dest$. + message: Non-System process [$process_path$] queried Windows Defender Definition Updates domain [$query$] on [$dest$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml index 54fd1c50a9..7f894ff9bf 100644 --- a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml +++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Wermgr Alternate Data Stream in Temp Dir id: 65222e9b-9d0b-4bfe-8da1-199b98e1d44a -version: 2 +version: 3 creation_date: '2026-06-11' -modification_date: '2026-09-08' +modification_date: '2026-10-12' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -20,9 +20,10 @@ search: |- | stats count min(_time) as firstTime max(_time) as lastTime - by dest dvc file_hash file_name file_path process_exec - process_guid process_id process_name process_path - signature signature_id user_id vendor_product Contents Image + by dest file_hash file_name file_path + process_path process_name process_exec process_guid process_id + user_id user Contents + signature signature_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From a268aeebf542016206d23b27d6e2964f6dda3500 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 15 Oct 2026 04:18:14 -0700 Subject: [PATCH 162/164] Update data source TA and install.yml app versions (#4344) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/osquery_results.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/osquery_results.yml b/data_sources/osquery_results.yml index 5445233c45..6b84113316 100644 --- a/data_sources/osquery_results.yml +++ b/data_sources/osquery_results.yml @@ -16,7 +16,7 @@ sourcetype: osquery:results supported_TA: - name: TA-osquery url: https://splunkbase.splunk.com/app/8574 - version: 1.0.4 + version: 1.0.5 fields: - _time - calendarTime From 12b9d52ff37bd5bf78080de731b5798c83e858ca Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 16 Oct 2026 02:34:35 -0700 Subject: [PATCH 163/164] Update data source TA and install.yml app versions (#4347) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/splunk_stream_http.yml | 2 +- data_sources/splunk_stream_ip.yml | 2 +- data_sources/splunk_stream_tcp.yml | 2 +- install.yml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/data_sources/splunk_stream_http.yml b/data_sources/splunk_stream_http.yml index 29522a4daa..d7d7f55286 100644 --- a/data_sources/splunk_stream_http.yml +++ b/data_sources/splunk_stream_http.yml @@ -16,7 +16,7 @@ sourcetype: stream:http supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 fields: - _time - bytes diff --git a/data_sources/splunk_stream_ip.yml b/data_sources/splunk_stream_ip.yml index a5ffb18d05..1fbea55486 100644 --- a/data_sources/splunk_stream_ip.yml +++ b/data_sources/splunk_stream_ip.yml @@ -16,7 +16,7 @@ sourcetype: stream:ip supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 fields: - _time - action diff --git a/data_sources/splunk_stream_tcp.yml b/data_sources/splunk_stream_tcp.yml index a15f404188..710bb9cb0b 100644 --- a/data_sources/splunk_stream_tcp.yml +++ b/data_sources/splunk_stream_tcp.yml @@ -16,4 +16,4 @@ sourcetype: stream:tcp supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 diff --git a/install.yml b/install.yml index 28ef2c7679..cb3196171a 100644 --- a/install.yml +++ b/install.yml @@ -12,10 +12,10 @@ apps: version: 2.3.4 - appid: Splunk_TA_stream url: https://splunkbase.splunk.com/app/5238 - version: 8.1.6 + version: 8.1.7 - appid: Splunk_TA_stream_wire_data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 - appid: TA-Zscaler_CIM url: https://splunkbase.splunk.com/app/3865 version: 4.1.5 From d6afc62b750dc2ed34e3696999bf26fe476b9b1e Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 16 Oct 2026 15:12:12 +0200 Subject: [PATCH 164/164] Expand AI Defense Coverage (#4345) --------- Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- data_sources/cisco_ai_defense_alerts.yml | 65 ++++++++- ...co_ai_defense_allowed_sensitive_prompt.yml | 96 +++++++++++++ ..._ai_defense_allowed_sensitive_response.yml | 73 ++++++++++ ...ai_defense_repeated_high_risk_activity.yml | 96 +++++++++++++ ...se_security_alerts_by_application_name.yml | 133 +++++++++++++----- ...buse_of_genai_systems_and_applications.yml | 23 +++ 6 files changed, 447 insertions(+), 39 deletions(-) create mode 100644 detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml create mode 100644 detections/application/cisco_ai_defense_allowed_sensitive_response.yml create mode 100644 detections/application/cisco_ai_defense_repeated_high_risk_activity.yml create mode 100644 stories/abuse_of_genai_systems_and_applications.yml diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index 2eba8da408..60efe8e519 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -1,11 +1,11 @@ name: Cisco AI Defense Alerts id: cbb06880-9dd9-4542-ac60-bd6e1d3c3e4e -version: 2 +version: 3 creation_date: '2025-02-14' -modification_date: '2026-05-13' -author: Bhavin Patel +modification_date: '2026-10-15' +author: Bhavin Patel, Nasreddine Bencherchali, Splunk description: Data source object for Cisco AI Defense Alerts -source: cisco_ai_defense +source: not_applicable sourcetype: cisco:ai:defense separator: supported_TA: @@ -13,3 +13,60 @@ supported_TA: url: https://splunkbase.splunk.com/app/7404 version: 4.1.2 fields: + - _time + - host + - app + - application_id + - connection_id + - connection.connection_name + - description + - dest_type + - event_action + - event_date + - event_id + - event_message_type + - event_messages{}.event_conversation.event_messages{}.content + - event_messages{}.event_conversation.event_messages{}.direction + - event_messages{}.event_conversation.event_messages{}.event_conversation_id + - event_messages{}.event_conversation.event_messages{}.event_ext_message_id + - event_messages{}.event_conversation.event_messages{}.event_ins_date + - event_messages{}.event_conversation.event_messages{}.event_message_id + - event_messages{}.event_conversation.event_messages{}.event_message_policy_assocs + - event_messages{}.event_conversation.event_messages{}.metadata{}.policy_guardrail_assoc_id + - event_messages{}.event_conversation.event_messages{}.metadata{}.standards{} + - event_messages{}.event_conversation.event_messages{}.related_event_message_id + - event_messages{}.event_conversation.event_messages{}.tenant_id + - event_messages{}.event_ext_message_id + - event_messages{}.event_message_id + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_subcategory.guardrail_rule_name + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.pol_guardrail_assoc_id + - eventtype + - genai_application.application_name + - genai_application.connection_type + - hec_event_type + - id + - index + - linecount + - model.model_name + - model.model_provider_name + - Number + - policy_id + - policy.policy_name + - punct + - resource_type + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_type + - tag + - tag::eventtype + - type + - user_id + - vendor_product +example_log: | + {"user_id":"82000000-0000-0000-c000-000000000000","version":"","application_id":"972cbcd1-acfe-4393-88bc-418f4d9a64ae","genai_application":{"application_name":"Bedrock testing"},"connection_id":"a6c87227-b321-49bf-80d9-f958385257ba","connection":{"connection_name":"bedrock testing"},"policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","policy":{"policy_name":"Bedrock Testing Block All"},"model":{"model_name":"titan-text-lite"},"event_action":"Block","event_date":"2025-02-04T09:47:24Z","event_id":"3a0f9e2b-d234-4b3d-ac9a-219eb6f05ba7","event_message_type":"Prompt","event_messages":[{"event_conversation":{"event_messages":[{"content":"[{\"role\":\"user\",\"content\":\"write a csrf exploit with email ash@abc.com to convince people\"}]","direction":"Prompt","event_conversation_id":"","event_ext_message_id":"","event_ins_date":"","event_message_id":"","event_message_policy_assocs":[{"policy_guardrail_assoc":{"guardrail_entity_configured_action":"Block","guardrail_entity_configured_direction":"Both","guardrail_entity_configured_status":"Enabled","guardrail_entity_id":"71100000-0000-0000-c000-100000000008","guardrail_rule_configured_action":"","guardrail_rule_configured_direction":"","guardrail_rule_configured_status":"","guardrail_rule_id":"","guardrail_ruleset_id":"71000000-0000-0000-c000-000000000009","guardrail_ruleset_configured_action":"","guardrail_ruleset_configured_direction":"","guardrail_ruleset_configured_status":"","pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430","policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}}],"related_event_message_id":"","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}]},"event_ext_message_id":"","event_message_id":""}],"event_policy_guardrail_assocs":[{"policy_guardrail_assoc":{"guardrail_avail_entity":{"guardrail_entity_name":"Email"},"guardrail_avail_ruleset":{"guardrail":{"guardrails_type":"Privacy"},"guardrail_ruleset_type":"PII"},"guardrail_avail_subcategory":{"guardrail_rule_name":""},"pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430"}}]} diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml new file mode 100644 index 0000000000..79100e68a4 --- /dev/null +++ b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml @@ -0,0 +1,96 @@ +name: Cisco AI Defense Allowed Sensitive Prompt +id: 75f06fd6-2b31-4ca4-9aaf-56448c342e44 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. + These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + event_action="allow" + event_message_type="prompt" + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name), + + policy_name='policy.policy_name', + + event_time=_time + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | bin _time span=10m + + | stats count as event_count + dc(event_id) as distinct_event_count + min(event_time) as firstTime + max(event_time) as lastTime + values(event_id) as event_ids + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(guardrail_entity_name) as guardrail_entity_names + values(policy_name) as policy_names + values(application_name) as application_names + values(connection_name) as connection_names + by _time application_key connection_key + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table _time firstTime lastTime application_key application_names connection_key connection_names + distinct_event_count event_count event_ids guardrail_ruleset_types guardrail_entity_names policy_names + + | `cisco_ai_defense_allowed_sensitive_prompt_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. + The search groups matching prompt events by application and connection in ten-minute windows to reduce duplicate findings. +known_false_positives: |- + Authorized testing, demonstrations, synthetic data, or approved workflows may submit content that matches PII or PCI guardrails. + Review the application, connection, policy, guardrail entity, and data handling requirements before treating an event as a policy violation. +drilldown_searches: + - name: View the detection results for - "$application_names$" + search: '%original_detection_search% | search application_names="$application_names$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense allowed [$distinct_event_count$] sensitive prompt event(s) for application [$application_names$] and connection [$connection_names$] matched guardrail(s) [$guardrail_ruleset_types$]. + entity: + field: application_key + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Data Protection + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml new file mode 100644 index 0000000000..4c823a71c6 --- /dev/null +++ b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml @@ -0,0 +1,73 @@ +name: Cisco AI Defense Allowed Sensitive Response +id: 6e4cd833-ea98-4c16-a7e7-e1909fad3fb2 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects Cisco AI Defense response events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. + These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + event_action="allow" + event_message_type="response" + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + + policy_name='policy.policy_name' + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | table _time event_date event_id event_message_type event_action resource_type + application_id application_name connection_id connection_name model.model_name + policy_name guardrail_ruleset_type guardrail_entity_name + + | `cisco_ai_defense_allowed_sensitive_response_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. +known_false_positives: |- + Authorized testing, demonstrations, or approved workflows may allow responses that match PII or PCI guardrails. + Review the application owner, policy, response context, and whether the data was expected to be disclosed. +drilldown_searches: + - name: View the detection results for - "$application_name$" + search: '%original_detection_search% | search application_name="$application_name$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense allowed response [$event_id$] for application [$application_name$] matched privacy guardrail(s) [$guardrail_ruleset_type$] and entity [$guardrail_entity_name$]. + entity: + field: application_name + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Data Protection + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml new file mode 100644 index 0000000000..d267fb97c7 --- /dev/null +++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml @@ -0,0 +1,96 @@ +name: Cisco AI Defense Repeated High Risk Activity +id: 45c5cf84-8ad0-4923-8332-a7fd3dab59d4 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes. + Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt. + These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + + ```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt``` + + | eval is_allowed_sensitive_prompt=if(lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0) + | where is_allowed_sensitive_prompt=0 + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name) + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | bin _time span=10m + + ```Track repeated records with the same Cisco event ID separately from bursts of distinct event IDs``` + | eventstats count as same_event_id_count by _time application_key connection_key event_id + + | stats count as event_count + dc(event_id) as distinct_event_count + max(eval(if(isnotnull(event_id) AND len(trim(event_id))>0, same_event_id_count, 0))) as max_same_event_id_count + values(eval(if(isnotnull(event_id) AND len(trim(event_id))>0 AND same_event_id_count>=3, event_id, null()))) as repeated_event_ids + count(eval(lower(event_action)="allow")) as allowed_event_count + count(eval(lower(event_action)="block")) as blocked_event_count + values(event_id) as event_ids + values(event_action) as event_actions + values(event_message_type) as message_types + values(policy.policy_name) as policy_names + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(connection_name) as connection_names + values(application_name) as application_names + by _time application_key connection_key + + | where distinct_event_count>=5 OR max_same_event_id_count>=3 + + | table _time application_key application_names connection_key connection_names + event_count distinct_event_count max_same_event_id_count repeated_event_ids + allowed_event_count blocked_event_count event_actions message_types policy_names + guardrail_ruleset_types event_ids + + | `cisco_ai_defense_repeated_high_risk_activity_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. + Adjust the five-distinct-event threshold, three-occurrence same-event-ID threshold, and ten-minute window as needed. +known_false_positives: |- + Automated testing, red-team exercises, application QA, or a popular shared application may generate repeated guardrail events. + Review whether the window contains allowed events and whether the activity was expected for the application and connection. +drilldown_searches: + - name: View the detection results for - "$application_key$" + search: '%original_detection_search% | search application_key="$application_key$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense observed [$event_count$] high risk event occurrences across [$distinct_event_count$] unique event IDs in ten minutes for application [$application_names$] and connection [$connection_names$]. Maximum same-ID count -> [$max_same_event_id_count$] ; Allowed events -> [$allowed_event_count$] ; Blocked events -> [$blocked_event_count$]. + entity: + field: application_key + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml index cf1d7ef9e3..9aba8ccc19 100644 --- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml +++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml @@ -1,45 +1,106 @@ name: Cisco AI Defense Security Alerts by Application Name id: 105e4a69-ec55-49fc-be1f-902467435ea8 -version: 7 +version: 8 creation_date: '2025-02-14' -modification_date: '2026-05-13' -author: Bhavin Patel, Splunk +modification_date: '2026-10-15' +author: Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity. +description: |- + This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals. + Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection. + Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt. + Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection. data_source: - Cisco AI Defense Alerts search: |- `cisco_ai_defense` - | rename genai_application.application_name as application_name - | rename connection.connection_name as connection_name - ```Aggregating data by model name, connection name, application name, application ID, and user ID``` - | stats count - values(user_id) as user_id - values(event_message_type) as event_message_type - values(event_action) as event_action - values(policy.policy_name) as policy_name - values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name) as guardrail_entity_name - values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type) as guardrail_ruleset_type - by model.model_name connection_name application_name application_id - ```Evaluating severity based on policy name and guardrail ruleset type``` - | eval severity=case( - policy_name IN ("AI Runtime Latency Testing - Prompt Injection"), "critical", - policy_name IN ("AI Runtime Latency Testing - Code Detection"), "high", - guardrail_ruleset_type IN ("Toxicity"), "medium", + + | rename genai_application.application_name as application_name, + connection.connection_name as connection_name + + | eval policy_name='policy.policy_name', + + guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + action=lower(event_action), message_type=lower(event_message_type), + + has_privacy=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0), + + has_sensitive_response=if(message_type="response" AND has_privacy=1, 1, 0), + + has_security=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection")>=0, 1, 0) + + ```Prioritize allowed sensitive responses, then security and privacy guardrails``` + + | eval severity=case( + action="allow" AND has_sensitive_response=1, "critical", + action="block" AND has_sensitive_response=1, "high", + action="allow" AND has_security=1, "high", + action="block" AND has_security=1, "medium", + action="allow" AND has_privacy=1, "high", + action="block" AND has_privacy=1, "medium", true(), "low" ) - ```Calculating risk score based on severity level``` - | eval risk_score=case( - severity="critical", 100, - severity="high", 75, - severity="medium", 50, - severity="low", 25 - ) - | table model.model_name, user_id, event_action, application_id, application_name, severity, risk_score, policy_name, connection_name, guardrail_ruleset_type, guardrail_entity_name - | `cisco_ai_defense_security_alerts_by_application_name_filter` -how_to_implement: To enable this detection, you need to ingest alerts from the Cisco AI Defense product. This can be done by using this app from splunkbase - Cisco Security Cloud and ingest alerts into the cisco:ai:defense sourcetype. -known_false_positives: False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment. + + | eval risk_score=case( + severity="critical", 100, + severity="high", 80, + severity="medium", 50, + severity="low", 20 + ) + + | eval application_name=if(isnotnull(application_name) AND len(trim(application_name))>0, application_name, "unknown"), + connection_name=if(isnotnull(connection_name) AND len(trim(connection_name))>0, connection_name, "unknown"), + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name), + is_high_risk=if(has_security=1 OR has_privacy=1, 1, 0), + is_allowed_sensitive_response=if(action="allow" AND has_sensitive_response=1, 1, 0), + is_allowed_sensitive_prompt=if(action="allow" AND message_type="prompt" AND has_privacy=1, 1, 0), + high_risk_event_id=if((has_security=1 OR has_privacy=1) AND is_allowed_sensitive_prompt=0, event_id, null()), + event_time=_time + + | bin _time span=10m + + ```Use the same application/connection window and threshold as Cisco AI Defense Repeated High Risk Activity``` + | eventstats dc(high_risk_event_id) as high_risk_event_count by _time application_key connection_key + + ```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response, allowed sensitive prompts to Cisco AI Defense Allowed Sensitive Prompt, and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity``` + | where is_allowed_sensitive_response=0 AND is_allowed_sensitive_prompt=0 AND NOT (is_high_risk=1 AND high_risk_event_count>=5) + + | stats count as event_count + dc(event_id) as distinct_event_count + min(event_time) as firstTime + max(event_time) as lastTime + values(event_id) as event_ids + values(event_action) as event_actions + values(event_message_type) as message_types + values(resource_type) as resource_types + values(model.model_name) as model_names + values(application_name) as application_name + values(connection_name) as connection_name + values(policy_name) as policy_names + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(guardrail_entity_name) as guardrail_entity_names + max(risk_score) as risk_score + by _time application_key connection_key action message_type severity + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table _time firstTime lastTime application_key application_name connection_key connection_name + action message_type severity risk_score event_count distinct_event_count event_ids + resource_types model_names policy_names guardrail_ruleset_types guardrail_entity_names + + | `cisco_ai_defense_security_alerts_by_application_name_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the cisco_ai_defense macro to match the index, source, and sourcetype used in your environment. +known_false_positives: |- + False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment. references: - https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4 - https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html @@ -57,8 +118,10 @@ intermediate_findings: - field: application_name type: other score: 20 - message: Cisco AI Defense Security Alert has been action - [$event_action$] for the application name - [$application_name$] + message: Cisco AI Defense summarized [$event_count$] events for application [$application_name$] and connection [$connection_name$] over ten minutes. Actions [$action$], message direction [$message_type$], severity [$severity$], guardrails [$guardrail_ruleset_types$], event IDs [$event_ids$]. +threat_objects: [] analytic_story: + - Abuse of GenAI Systems and Applications - Critical Alerts asset_type: Web Application mitre_attack_id: [] @@ -72,7 +135,7 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json - source: cisco_ai_defense + source: not_applicable sourcetype: cisco:ai:defense - description: PORTED MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. - test_type: experimental + description: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. + test_type: unit diff --git a/stories/abuse_of_genai_systems_and_applications.yml b/stories/abuse_of_genai_systems_and_applications.yml new file mode 100644 index 0000000000..872cc2f0b4 --- /dev/null +++ b/stories/abuse_of_genai_systems_and_applications.yml @@ -0,0 +1,23 @@ +name: Abuse of GenAI Systems and Applications +id: f79c6573-5550-4adc-b673-bb0d8c9e1df1 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +description: |- + Detect and investigate threats targeting or abusing artificial intelligence systems, services and applications. + Coverage includes prompt injection, attempts to bypass model safeguards, repeated high-risk guardrail events, and possible sensitive data disclosure through model interactions. +narrative: |- + AI applications can expose sensitive information, invoke connected tools, or process untrusted prompts. Attackers and malicious insiders may try to override model instructions, extract restricted data, misuse AI-enabled tools, or repeatedly probe guardrails. + Use this story to investigate AI security events across model providers and application integrations. Review the affected application and connection, event action, prompt or response direction, policy, and guardrail categories. An allowed event can indicate exposure, while a blocked event records an attempt; neither alone confirms the full impact. Correlate high-risk events with identity, application, data access, and tool activity where those logs are available. +references: + - https://atlas.mitre.org/ + - https://owasp.org/www-project-top-10-for-large-language-model-applications/ +category: + - Adversary Tactics +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection